@indigoai-us/hq-cli 5.50.2 → 5.51.0

package/dist/node-preflight.js

@@ -0,0 +1,55 @@
+/**
+ * Runtime Node.js version guard for the hq CLI.
+ *
+ * HQ tooling requires Node.js 20 or newer. On older runtimes (notably Node 18)
+ * the CLI dies with cryptic failures long before reaching any of its own code:
+ * a native-module ABI mismatch from a prebuilt dependency, and a missing
+ * `util.styleText` (added in Node 20). Those errors give the user no hint that
+ * the real problem is just an old Node.
+ *
+ * This module exists to fail fast with an actionable message instead. It is
+ * imported FIRST by every CLI entry point (`index.ts`, `bin/hq-auth-refresh.ts`)
+ * so the check runs before commander, Sentry, or any dependency that needs a
+ * Node 20+ API or a newer native ABI is evaluated. ES modules evaluate their
+ * imports in source order, so as long as this is the first import in the entry
+ * module, the guard short-circuits an unsupported runtime cleanly.
+ *
+ * Keep this file dependency-free — it must not import anything that could itself
+ * fail to load on the very runtime it is trying to detect.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7d63229d-ff96-5511-9601-53c556487763")}catch(e){}}();
+export const MIN_NODE_MAJOR = 20;
+/**
+ * Pure check: is the given Node version string (e.g. "18.19.0") supported?
+ * Defaults to the running runtime's version. An unparseable version is treated
+ * as supported so we never block a user on a version string we can't read.
+ */
+export function checkNodeVersion(versionString = process.versions.node) {
+    const major = Number.parseInt(String(versionString).split(".")[0] ?? "", 10);
+    if (!Number.isFinite(major) || major >= MIN_NODE_MAJOR) {
+        return { ok: true, major };
+    }
+    const message = `hq requires Node.js ${MIN_NODE_MAJOR} or newer — you are running Node ${versionString}.\n` +
+        `Older versions fail with native-module ABI mismatches and missing APIs.\n` +
+        `Please upgrade to Node ${MIN_NODE_MAJOR}+ (https://nodejs.org/) and run hq again.`;
+    return { ok: false, major, message };
+}
+/**
+ * Side-effecting guard run on import: prints the upgrade message to stderr and
+ * exits 1 on an unsupported runtime. A no-op on Node 20+. Set
+ * `HQ_SKIP_NODE_PREFLIGHT=1` to bypass (used by the test runner, which already
+ * runs on a supported Node).
+ */
+export function enforceNodeVersion() {
+    if (process.env.HQ_SKIP_NODE_PREFLIGHT)
+        return;
+    const result = checkNodeVersion();
+    if (!result.ok && result.message) {
+        process.stderr.write(`${result.message}\n`);
+        process.exit(1);
+    }
+}
+enforceNodeVersion();
+//# sourceMappingURL=node-preflight.js.map
+//# debugId=7d63229d-ff96-5511-9601-53c556487763

package/dist/sentry.d.ts

@@ -1,4 +1,16 @@
 import * as Sentry from "@sentry/node";
+import type { ErrorEvent, EventHint } from "@sentry/node";
+/**
+ * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
+ * reader (`hq … | head`, `source <(hq …)`, a parent that exited) is normal
+ * Unix behavior with no user-facing degradation — never a defect to report.
+ * This is the path-independent catch-all for HQ-6B: whichever way an EPIPE
+ * surfaces (a synchronous throw into the command catch, an async stream
+ * 'error', or a write outside the top-level try), it never ships a fatal. The
+ * clean-exit handlers in index.ts still keep exit code 0 for the common paths.
+ * Consistent with the swallow-EPIPE posture established in #138.
+ */
+export declare function epipeAwareBeforeSend(event: ErrorEvent, hint: EventHint): ErrorEvent | null;
 export declare function initSentry(): void;
 export { Sentry };
 //# sourceMappingURL=sentry.d.ts.map

package/dist/sentry.js

@@ -1,11 +1,27 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a260ea42-f6d8-52d0-90c6-6e586de5efd6")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a2ba6d5a-af8a-5512-9ce8-ced925ad5505")}catch(e){}}();
 import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
 import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { getCachedSentryUser } from "./utils/sentry-identity.js";
+import { isEpipe } from "./utils/epipe.js";
+/**
+ * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
+ * reader (`hq … | head`, `source <(hq …)`, a parent that exited) is normal
+ * Unix behavior with no user-facing degradation — never a defect to report.
+ * This is the path-independent catch-all for HQ-6B: whichever way an EPIPE
+ * surfaces (a synchronous throw into the command catch, an async stream
+ * 'error', or a write outside the top-level try), it never ships a fatal. The
+ * clean-exit handlers in index.ts still keep exit code 0 for the common paths.
+ * Consistent with the swallow-EPIPE posture established in #138.
+ */
+export function epipeAwareBeforeSend(event, hint) {
+    if (isEpipe(hint?.originalException))
+        return null;
+    return beforeSend(event, hint);
+}
 export function initSentry() {
     const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
     if (!dsn)
@@ -20,7 +36,7 @@ export function initSentry() {
         initialScope: {
             tags: { repo: "hq-cli" },
         },
-        beforeSend,
+        beforeSend: epipeAwareBeforeSend,
         beforeBreadcrumb,
     });
     // Attribute events to the logged-in HQ identity (best-effort; null when not
@@ -35,4 +51,4 @@ export function initSentry() {
 }
 export { Sentry };
 //# sourceMappingURL=sentry.js.map
-//# debugId=a260ea42-f6d8-52d0-90c6-6e586de5efd6
+//# debugId=a2ba6d5a-af8a-5512-9ce8-ced925ad5505

package/dist/utils/epipe.d.ts

@@ -0,0 +1,8 @@
+/**
+ * True when `err` is a Node EPIPE error — the pipe `hq` was writing to was
+ * closed by its reader. Callers should treat this as a clean, expected exit
+ * (code 0) and SKIP Sentry capture: there is no defect and no user-facing
+ * degradation to fix.
+ */
+export declare function isEpipe(err: unknown): boolean;
+//# sourceMappingURL=epipe.d.ts.map

package/dist/utils/epipe.js

@@ -0,0 +1,30 @@
+// src/utils/epipe.ts
+//
+// Classify the "broken pipe" (EPIPE) error: a downstream reader closed the
+// pipe before the CLI finished writing to stdout/stderr. This is normal,
+// expected Unix behavior — `hq … | head`, `source <(hq …)`, or a parent
+// process that exits while `hq` is still printing — NOT an HQ code defect.
+//
+// HQ-6B: a synchronous `write EPIPE` thrown from `console.log` (the Sentry
+// console-instrumentation wraps it) propagated out of an awaited command into
+// the CLI's top-level `catch`, which captured it via `Sentry.captureException`
+// and shipped a fatal — even though the only thing that happened is the
+// consumer of `hq`'s output went away. The async path (an emitted stream
+// 'error' event) was already handled by the stdout/stderr listeners in
+// index.ts; this predicate closes the synchronous-throw path too, mirroring
+// the environmental-error carve-out (HQ-CLI-2).
+/**
+ * True when `err` is a Node EPIPE error — the pipe `hq` was writing to was
+ * closed by its reader. Callers should treat this as a clean, expected exit
+ * (code 0) and SKIP Sentry capture: there is no defect and no user-facing
+ * degradation to fix.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3305e402-0237-55ac-a6d4-11143bc69b83")}catch(e){}}();
+export function isEpipe(err) {
+    return (typeof err === "object" &&
+        err !== null &&
+        err.code === "EPIPE");
+}
+//# sourceMappingURL=epipe.js.map
+//# debugId=3305e402-0237-55ac-a6d4-11143bc69b83

package/dist/utils/intercepted-process-exit.d.ts

@@ -0,0 +1,7 @@
+/**
+ * True when `err` is a fuzz/audit harness's intercepted-`process.exit` marker
+ * rather than a genuine fault. Callers should SKIP Sentry capture (no defect, no
+ * user-facing degradation) while preserving the intended exit code.
+ */
+export declare function isInterceptedProcessExit(err: unknown): boolean;
+//# sourceMappingURL=intercepted-process-exit.d.ts.map

package/dist/utils/intercepted-process-exit.js

@@ -0,0 +1,38 @@
+// src/utils/intercepted-process-exit.ts
+//
+// Classify the "intercepted process.exit" synthetic error (HQ-CLI-3).
+//
+// Security/audit FUZZ harnesses (e.g. `/opt/audit/fuzz-exports.js`) monkey-patch
+// `process.exit` to THROW a marker instead of actually terminating, so the
+// fuzzer can keep exercising a binary's entrypoints. When such a harness drives
+// `hq` (e.g. `hq <unknown-command>`), commander legitimately calls
+// `process.exit(1)` — and the patched exit turns that normal CLI control-flow
+// into a thrown `Error: fuzz-intercepted-process-exit` that propagates out of
+// `program.parseAsync()` into the CLI's top-level catch, which then shipped it to
+// Sentry as a fatal.
+//
+// This is a test-harness artifact, NOT an hq-cli defect: a real user's
+// `process.exit` exits the process and nothing is ever thrown or captured.
+// There is no user-facing degradation to fix, so the top-level catch skips
+// Sentry capture for it — the genuine "expected, non-actionable" carve-out,
+// mirroring the EPIPE (HQ-6B) and environmental-FS (HQ-CLI-2) carve-outs.
+/** The marker a fuzz/audit harness throws in place of a real `process.exit`. */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="55c7e3b5-a8bc-50fd-835b-127a19172aa1")}catch(e){}}();
+const INTERCEPTED_PROCESS_EXIT_MARKER = "fuzz-intercepted-process-exit";
+/**
+ * True when `err` is a fuzz/audit harness's intercepted-`process.exit` marker
+ * rather than a genuine fault. Callers should SKIP Sentry capture (no defect, no
+ * user-facing degradation) while preserving the intended exit code.
+ */
+export function isInterceptedProcessExit(err) {
+    if (typeof err === "object" && err !== null) {
+        const message = err.message;
+        if (typeof message === "string" && message.includes(INTERCEPTED_PROCESS_EXIT_MARKER)) {
+            return true;
+        }
+    }
+    return typeof err === "string" && err.includes(INTERCEPTED_PROCESS_EXIT_MARKER);
+}
+//# sourceMappingURL=intercepted-process-exit.js.map
+//# debugId=55c7e3b5-a8bc-50fd-835b-127a19172aa1

package/e2e/cli.test.ts

@@ -41,6 +41,31 @@ function runHq(args: string[], options: { cwd?: string; env?: NodeJS.ProcessEnv
   });
 }
 
+// Spawn the built CLI with its stdout read-end closed immediately, so the
+// child's first write to stdout hits EPIPE — the `hq … | head` / `source <(hq
+// …)` scenario behind HQ-6B. Returns the child's own exit code + stderr.
+function runHqWithClosedStdout(args: string[]) {
+  return new Promise<{ code: number | null; stderr: string }>(
+    (resolve, reject) => {
+      const child = spawn(process.execPath, [cliEntry, ...args], {
+        env: { ...process.env, HQ_NO_UPDATE_CHECK: "1" },
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+      let stderr = "";
+      child.stderr.setEncoding("utf8");
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk;
+      });
+      // Close the read end up front (and again on any byte that slips through)
+      // so subsequent writes by the child fail with EPIPE.
+      child.stdout.on("data", () => child.stdout.destroy());
+      child.stdout.destroy();
+      child.on("error", reject);
+      child.on("close", (code) => resolve({ code, stderr }));
+    },
+  );
+}
+
 async function makeTempDir(prefix: string) {
   const dir = await mkdtemp(path.join(tmpdir(), prefix));
   tempDirs.push(dir);
@@ -62,6 +87,16 @@ describe("built hq CLI", () => {
     expect(result.stdout).toContain("whoami");
   });
 
+  it("exits cleanly when the downstream reader closes the pipe (HQ-6B)", async () => {
+    // Regression for HQ-6B: a closed stdout reader must NOT crash the CLI with
+    // a fatal `write EPIPE`. The process should exit 0 with no EPIPE traceback.
+    const { code, stderr } = await runHqWithClosedStdout(["--help"]);
+
+    expect(code).toBe(0);
+    expect(stderr).not.toMatch(/EPIPE/);
+    expect(stderr).not.toMatch(/Error:/);
+  });
+
   it("prints the package version from the built entrypoint", async () => {
     const result = await runHq(["--version"]);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.50.2",
+  "version": "5.51.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/bin/hq-auth-refresh.ts

@@ -12,6 +12,9 @@
  * non-interactively.
  */
 
+// MUST be first: guard the Node version before any dependency that needs a
+// Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
+import "../node-preflight.js";
 import { initSentry, Sentry } from "../sentry.js";
 import { refreshCachedSession } from "../utils/cognito-session.js";
 

package/src/commands/members.test.ts

@@ -38,6 +38,7 @@ import {
   formatInviteHttpError,
   getCallerPersonUid,
   inviteMember,
+  listActiveMembers,
   listPendingInvites,
   registerMembersCommand,
   resendInvite,
@@ -743,6 +744,181 @@ describe("listPendingInvites", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// listActiveMembers
+// ---------------------------------------------------------------------------
+
+describe("listActiveMembers", () => {
+  it("GETs /membership/company/{uid} and returns the members array", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        members: [
+          {
+            membershipKey: "k1",
+            personUid: "prs_alice",
+            companyUid: "cmp_acme",
+            role: "owner",
+            status: "active",
+            personEmail: "alice@example.com",
+            personName: "Alice",
+          },
+        ],
+      }),
+    );
+
+    const members = await listActiveMembers("test-token", "cmp_acme");
+
+    const call = fetchSpy.mock.calls[0];
+    expect(String(call[0])).toMatch(/\/membership\/company\/cmp_acme$/);
+    expect(members).toHaveLength(1);
+    expect(members[0].personEmail).toBe("alice@example.com");
+    expect(members[0].role).toBe("owner");
+  });
+
+  it("returns [] when the members key is missing", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+    await expect(
+      listActiveMembers("test-token", "cmp_acme"),
+    ).resolves.toEqual([]);
+  });
+
+  it("returns [] when members is null", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { members: null }));
+    await expect(
+      listActiveMembers("test-token", "cmp_acme"),
+    ).resolves.toEqual([]);
+  });
+
+  it("throws InviteHttpError on non-ok", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(403, { error: "forbidden" }));
+    await expect(
+      listActiveMembers("test-token", "cmp_acme"),
+    ).rejects.toBeInstanceOf(InviteHttpError);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// registerMembersCommand list
+// ---------------------------------------------------------------------------
+
+describe("registerMembersCommand list", () => {
+  it("defaults to ACTIVE members: renders EMAIL/ROLE/NAME + the share hint", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        members: [
+          {
+            membershipKey: "k1",
+            personUid: "prs_alice",
+            companyUid: "cmp_acme",
+            role: "owner",
+            status: "active",
+            personEmail: "alice@example.com",
+            personName: "Alice",
+          },
+          {
+            membershipKey: "k2",
+            personUid: "prs_bob",
+            companyUid: "cmp_acme",
+            role: "member",
+            status: "active",
+            personSlug: "bob",
+          },
+        ],
+      }),
+    );
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "list"],
+      { from: "user" },
+    );
+
+    const call = fetchSpy.mock.calls[0];
+    expect(String(call[0])).toMatch(/\/membership\/company\/cmp_acme$/);
+    const output = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(output).toContain("EMAIL");
+    expect(output).toContain("ROLE");
+    expect(output).toContain("NAME");
+    expect(output).toContain("alice@example.com");
+    expect(output).toContain("owner");
+    expect(output).toContain("Alice");
+    // unresolved email falls back to personUid; name falls back to slug
+    expect(output).toContain("prs_bob");
+    expect(output).toContain("bob");
+    expect(output).toContain(
+      "hq secrets share <path> --with <email>",
+    );
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("default active: empty roster prints the no-active-members message", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { members: [] }));
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "list"],
+      { from: "user" },
+    );
+
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("No active members found for this company."),
+    );
+  });
+
+  it("--pending preserves the OLD pending-invites table verbatim", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        pending: [
+          {
+            membershipKey: "email:alice@example.com#cmp_acme",
+            inviteeEmail: "alice@example.com",
+            companyUid: "cmp_acme",
+            role: "member",
+            status: "pending",
+            invitedBy: "prs_admin",
+            invitedAt: "2026-05-21T12:00:00Z",
+          },
+        ],
+      }),
+    );
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "list", "--pending"],
+      { from: "user" },
+    );
+
+    const call = fetchSpy.mock.calls[0];
+    expect(String(call[0])).toMatch(
+      /\/membership\/company\/cmp_acme\/pending$/,
+    );
+    const output = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(output).toContain("TARGET");
+    expect(output).toContain("INVITED_BY");
+    expect(output).toContain("MEMBERSHIP_KEY");
+    expect(output).toContain("alice@example.com");
+    // the active-only share hint must NOT appear in the pending view
+    expect(output).not.toContain("hq secrets share");
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("--pending: empty invites prints the no-pending-invites message", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { pending: [] }));
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "list", "--pending"],
+      { from: "user" },
+    );
+
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("No pending invites for this company."),
+    );
+  });
+});
+
 // ---------------------------------------------------------------------------
 // revokeInvite
 // ---------------------------------------------------------------------------

package/src/commands/members.ts

@@ -31,6 +31,23 @@ interface MyMembership {
   status: string;
 }
 
+/**
+ * An ACTIVE member of a company, as returned by
+ * `GET /membership/company/{companyUid}`. The server filters to
+ * `status: "active"` and enriches each row with resolved person metadata
+ * (`personEmail` / `personName` / `personSlug`) when available.
+ */
+export interface ActiveMember {
+  membershipKey: string;
+  personUid: string;
+  companyUid: string;
+  role: string;
+  status: string;
+  personEmail?: string;
+  personName?: string;
+  personSlug?: string;
+}
+
 export interface InviteOptions {
   target: string;
   role: string;
@@ -374,6 +391,30 @@ export async function listPendingInvites(
   return data?.pending ?? data?.invites ?? [];
 }
 
+export async function listActiveMembers(
+  token: string,
+  companyUid: string,
+): Promise<ActiveMember[]> {
+  const res = await vaultApiFetch({
+    token,
+    path: `/membership/company/${encodeURIComponent(companyUid)}`,
+  });
+  if (!res.ok) {
+    const err = (await res.json().catch(() => ({}))) as Record<string, string>;
+    throw new InviteHttpError(
+      res.status,
+      err.message ?? err.error ?? res.statusText,
+      err.code,
+    );
+  }
+  // Server schema: `{ members: [...] }` — active members only, enriched with
+  // resolved person metadata (personEmail / personName / personSlug).
+  const data = (await res.json()) as {
+    members?: ActiveMember[] | null;
+  };
+  return data?.members ?? [];
+}
+
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:
@@ -746,55 +787,99 @@ export function registerMembersCommand(program: Command): void {
 
   members
     .command("list")
-    .description("List pending invites for the company")
-    .action(async () => {
+    .description(
+      "List the company's active members (use --pending for pending invites)",
+    )
+    .option("--pending", "List pending invites instead of active members")
+    .action(async (opts: { pending?: boolean }) => {
       try {
         const token = await ensureCognitoToken();
         const companySlug = members.opts().company as string | undefined;
         const companyUid = await getCompanyUid(token, companySlug);
 
-        const invites = await listPendingInvites(token, companyUid);
+        if (opts.pending) {
+          // --pending: preserve the original pending-invites view verbatim.
+          const invites = await listPendingInvites(token, companyUid);
+
+          if (invites.length === 0) {
+            console.log(chalk.gray("No pending invites for this company."));
+            return;
+          }
 
-        if (invites.length === 0) {
-          console.log(chalk.gray("No pending invites for this company."));
+          const targetW = Math.max(
+            6,
+            ...invites.map((i) => (i.inviteeEmail ?? i.personUid ?? "").length),
+          );
+          const roleW = Math.max(4, ...invites.map((i) => i.role.length));
+          const byW = Math.max(10, ...invites.map((i) => i.invitedBy.length));
+          const keyW = Math.max(
+            14,
+            ...invites.map((i) => i.membershipKey.length),
+          );
+          console.log(
+            chalk.bold(
+              [
+                "TARGET".padEnd(targetW),
+                "ROLE".padEnd(roleW),
+                "INVITED_BY".padEnd(byW),
+                "INVITED_AT",
+                "MEMBERSHIP_KEY".padEnd(keyW),
+              ].join("  "),
+            ),
+          );
+          for (const inv of invites) {
+            const target = inv.inviteeEmail ?? inv.personUid ?? "";
+            console.log(
+              [
+                target.padEnd(targetW),
+                inv.role.padEnd(roleW),
+                inv.invitedBy.padEnd(byW),
+                shortDate(inv.invitedAt),
+                inv.membershipKey.padEnd(keyW),
+              ].join("  "),
+            );
+          }
           return;
         }
 
-        const targetW = Math.max(
-          6,
-          ...invites.map((i) => (i.inviteeEmail ?? i.personUid ?? "").length),
+        // Default: list ACTIVE members so their emails drop straight into
+        // `hq secrets share <path> --with <email>`.
+        const activeMembers = await listActiveMembers(token, companyUid);
+
+        if (activeMembers.length === 0) {
+          console.log(chalk.gray("No active members found for this company."));
+          return;
+        }
+
+        const emailW = Math.max(
+          5,
+          ...activeMembers.map((m) => (m.personEmail ?? m.personUid).length),
         );
-        const roleW = Math.max(4, ...invites.map((i) => i.role.length));
-        const byW = Math.max(10, ...invites.map((i) => i.invitedBy.length));
-        const keyW = Math.max(14, ...invites.map((i) => i.membershipKey.length));
+        const roleW = Math.max(4, ...activeMembers.map((m) => m.role.length));
         console.log(
           chalk.bold(
-            [
-              "TARGET".padEnd(targetW),
-              "ROLE".padEnd(roleW),
-              "INVITED_BY".padEnd(byW),
-              "INVITED_AT",
-              "MEMBERSHIP_KEY".padEnd(keyW),
-            ].join("  "),
+            ["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW), "NAME"].join("  "),
           ),
         );
-        for (const inv of invites) {
-          const target = inv.inviteeEmail ?? inv.personUid ?? "";
+        for (const m of activeMembers) {
+          const email = m.personEmail ?? m.personUid;
+          const name = m.personName ?? m.personSlug ?? "";
           console.log(
-            [
-              target.padEnd(targetW),
-              inv.role.padEnd(roleW),
-              inv.invitedBy.padEnd(byW),
-              shortDate(inv.invitedAt),
-              inv.membershipKey.padEnd(keyW),
-            ].join("  "),
+            [email.padEnd(emailW), m.role.padEnd(roleW), name].join("  "),
           );
         }
+        console.log(
+          chalk.gray(
+            "Share a secret with a member: hq secrets share <path> --with <email>",
+          ),
+        );
       } catch (err) {
         if (err instanceof InviteHttpError) {
           const msg =
             err.status === 403
-              ? "Not authorized — only admins and owners can list invites"
+              ? opts.pending
+                ? "Not authorized — only admins and owners can list invites"
+                : "Not authorized — only company members can list members"
               : formatInviteHttpError(err.status, err.message);
           console.error(chalk.red(msg));
           process.exit(1);