@indigoai-us/hq-cli 5.50.2 → 5.52.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [5.52.0]
+
+### Added
+
+- **`hq members promote <target> <newRole>` (alias `set-role`) — change a
+  member's role from the CLI.** A discoverable runner for role changes via
+  `POST /membership/role`, replacing the undiscoverable, `admin|member`-only
+  `set-role` (now kept as an alias). Supports the full role set
+  (`owner|admin|member|guest`); `<target>` may be an email, a `prs_` personUid,
+  or a full membership key (same resolver as `revoke`). It is a GENERAL role
+  change — it can promote OR demote — and authorization (owner-or-admin; only
+  an owner may set a target to owner or change an owner) is enforced
+  server-side.
+- **`hq files share --full` — glob-safe whole-vault access.** Granting prefixes
+  one at a time hit `PolicyBudgetExceeded` after a few (each prefix is a
+  distinct ARN in the member's DEFLATE-packed inline STS session policy), and
+  the intended single-`*` wildcard escape hatch was unreachable because an
+  unquoted `*` expands to local filenames and fails the one-prefix check.
+  `--full` is a glob-safe flag that performs the coalesced whole-vault wildcard
+  grant in a single policy entry.
+
+## [5.51.0]
+
 ### Fixed
 
 - **`hq secrets exec` / `hq secrets env` load via the batch endpoint, killing

package/dist/bin/hq-auth-refresh.d.ts

@@ -10,5 +10,5 @@
  * machine-token mint). Exit 1 if no valid session could be ensured
  * non-interactively.
  */
-export {};
+import "../node-preflight.js";
 //# sourceMappingURL=hq-auth-refresh.d.ts.map

package/dist/bin/hq-auth-refresh.js

@@ -10,8 +10,11 @@
  * machine-token mint). Exit 1 if no valid session could be ensured
  * non-interactively.
  */
+// MUST be first: guard the Node version before any dependency that needs a
+// Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="03d2c531-f620-5d93-a87b-9a87264ad77b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3c7e1b4e-66dc-5fe8-b828-cd3636df1fbb")}catch(e){}}();
+import "../node-preflight.js";
 import { initSentry, Sentry } from "../sentry.js";
 import { refreshCachedSession } from "../utils/cognito-session.js";
 initSentry();
@@ -38,4 +41,4 @@ initSentry();
     }
 })();
 //# sourceMappingURL=hq-auth-refresh.js.map
-//# debugId=03d2c531-f620-5d93-a87b-9a87264ad77b
+//# debugId=3c7e1b4e-66dc-5fe8-b828-cd3636df1fbb

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fc999359-c426-5277-ba96-5452ae1ed2e2")}catch(e){}}();
 import chalk from "chalk";
 import open from "open";
 import * as readline from "node:readline";
@@ -99,10 +99,35 @@ export function registerFilesCommand(program) {
         .description("Share file paths. Without --with: mint a share-session URL and open it in the browser. With --with: grant access directly to a person, group, or @all.")
         .option("--with <principal>", "Email address, group id, or '@all' to share with every active company member")
         .option("--permission <level>", "Permission level (only with --with): read | write")
+        .option("--full", "Grant access to the ENTIRE vault (the '*' wildcard prefix) — no need to quote a glob. Requires --with; defaults to write permission.")
         .option("--expires <duration>", "Token expiry duration for share-session URL (e.g. 15m, 1h, 24h). Default 15m. Max 24h.")
         .option("--no-open", "Print the share-session URL but do not launch the browser")
         .action(async (paths, opts) => {
         try {
+            // Full-vault grant: a glob-safe affordance for "give this person the
+            // whole vault" so admins never have to quote a `*` (an unquoted glob
+            // expands to local filenames and instantly fails the one-prefix
+            // check). Maps to the single `*` wildcard grant, which the server
+            // coalesces to one policy entry — sidestepping the per-prefix STS
+            // session-policy budget. Defaults to write permission.
+            if (opts.full) {
+                if (opts.with === undefined) {
+                    console.error(chalk.red("--full grants whole-vault access to a principal and requires --with <principal>."));
+                    process.exit(1);
+                }
+                if (paths && paths.length > 0) {
+                    console.error(chalk.red("--full grants the entire vault; do not also pass file paths."));
+                    process.exit(1);
+                }
+                await runDirectGrant({
+                    prefix: "*",
+                    principal: opts.with,
+                    permission: opts.permission ?? "write",
+                    companySlug: files.opts().company,
+                    fullVault: true,
+                });
+                return;
+            }
             if (!paths || paths.length === 0) {
                 console.error(chalk.red("usage: hq files share <paths...> [--with <principal>]"));
                 process.exit(1);
@@ -437,7 +462,12 @@ async function runDirectGrant(params) {
     const data = (await res.json());
     const printedPrefix = data.acl?.path ?? data.acl?.prefix ?? canonicalPrefix;
     const verb = autoCreated ? "Created ACL and granted" : "Granted";
-    console.log(chalk.green(`${verb} ${params.permission} on ${printedPrefix} to ${principalLabel}`));
+    if (params.fullVault) {
+        console.log(chalk.green(`${verb} ${params.permission} on the ENTIRE vault to ${principalLabel}`));
+    }
+    else {
+        console.log(chalk.green(`${verb} ${params.permission} on ${printedPrefix} to ${principalLabel}`));
+    }
 }
 async function runShareSession(params) {
     // Normalize every path through the shared prefix helper so a trailing
@@ -682,4 +712,4 @@ export async function runFilesDelete(params, deps = {}) {
     }
 }
 //# sourceMappingURL=files.js.map
-//# debugId=bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6
+//# debugId=fc999359-c426-5277-ba96-5452ae1ed2e2

package/dist/commands/members.d.ts

@@ -12,6 +12,22 @@ export interface PendingInvite {
     invitedBy: string;
     invitedAt: string;
 }
+/**
+ * An ACTIVE member of a company, as returned by
+ * `GET /membership/company/{companyUid}`. The server filters to
+ * `status: "active"` and enriches each row with resolved person metadata
+ * (`personEmail` / `personName` / `personSlug`) when available.
+ */
+export interface ActiveMember {
+    membershipKey: string;
+    personUid: string;
+    companyUid: string;
+    role: string;
+    status: string;
+    personEmail?: string;
+    personName?: string;
+    personSlug?: string;
+}
 export interface InviteOptions {
     target: string;
     role: string;
@@ -114,6 +130,7 @@ export declare class InviteHttpError extends Error {
 }
 export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
+export declare function listActiveMembers(token: string, companyUid: string): Promise<ActiveMember[]>;
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:
@@ -132,5 +149,15 @@ export declare function listPendingInvites(token: string, companyUid: string): P
  */
 export declare function resolveRevokeTargetToMembershipKey(arg: string, companyUid: string): string;
 export declare function revokeInvite(token: string, tokenOrKey: string, companyUid: string): Promise<void>;
+/**
+ * Change a member's role via `POST /membership/role`, accepting the FULL role
+ * set (owner|admin|member|guest). This is a GENERAL role change — it can promote
+ * OR demote. Authorization (owner-or-admin `changeRoles`, owner-only
+ * promote-to-owner / change-an-owner) is enforced SERVER-side; this function
+ * only validates the role string locally and surfaces the server's error.
+ * Role string is validated BEFORE any network call so callers/tests can rely on
+ * a synchronous-shaped rejection for a bad role.
+ */
+export declare function changeMemberRole(token: string, companyUid: string, membershipKey: string, newRole: Role): Promise<void>;
 export declare function registerMembersCommand(program: Command): void;
 //# sourceMappingURL=members.d.ts.map

package/dist/commands/members.js

@@ -1,12 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="40f5379c-742e-5cd5-aba2-931856dc7dd3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="83a54ed2-3f52-5b6f-a784-09f78f488ddd")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 export const VALID_ROLES = new Set(["owner", "admin", "member", "guest"]);
-const VALID_MEMBER_SET_ROLES = new Set(["admin", "member"]);
 export function detectTarget(target) {
     if (EMAIL_PATTERN.test(target)) {
         return { type: "email", value: target.trim().toLowerCase() };
@@ -196,6 +195,20 @@ export async function listPendingInvites(token, companyUid) {
     const data = (await res.json());
     return data?.pending ?? data?.invites ?? [];
 }
+export async function listActiveMembers(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/membership/company/${encodeURIComponent(companyUid)}`,
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
+    }
+    // Server schema: `{ members: [...] }` — active members only, enriched with
+    // resolved person metadata (personEmail / personName / personSlug).
+    const data = (await res.json());
+    return data?.members ?? [];
+}
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:
@@ -251,9 +264,18 @@ export async function revokeInvite(token, tokenOrKey, companyUid) {
         throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
 }
-async function setMemberRole(token, companyUid, membershipKey, newRole) {
-    if (!VALID_MEMBER_SET_ROLES.has(newRole)) {
-        throw new Error(`Invalid role '${newRole}': must be one of admin, member`);
+/**
+ * Change a member's role via `POST /membership/role`, accepting the FULL role
+ * set (owner|admin|member|guest). This is a GENERAL role change — it can promote
+ * OR demote. Authorization (owner-or-admin `changeRoles`, owner-only
+ * promote-to-owner / change-an-owner) is enforced SERVER-side; this function
+ * only validates the role string locally and surfaces the server's error.
+ * Role string is validated BEFORE any network call so callers/tests can rely on
+ * a synchronous-shaped rejection for a bad role.
+ */
+export async function changeMemberRole(token, companyUid, membershipKey, newRole) {
+    if (!VALID_ROLES.has(newRole)) {
+        throw new Error(`Invalid role '${newRole}': must be one of owner, admin, member, guest`);
     }
     const res = await vaultApiFetch({
         token,
@@ -271,16 +293,29 @@ export function registerMembersCommand(program) {
         .command("members")
         .description("Manage company memberships and invites")
         .option("--company <slug>", "Company slug (resolves to companyUid)");
+    // Canonical role-change command. `promote` is the discoverable verb users
+    // reach for; `set-role` is kept as an alias for the older name. The route is a
+    // GENERAL role change, so the help text and success message are honest that it
+    // can demote as well as promote. Authorization is enforced server-side.
     members
-        .command("set-role <membershipKey> <role>")
-        .description("Change a member or agent role to admin or member")
-        .action(async (membershipKey, role) => {
+        .command("promote <target> <newRole>")
+        .alias("set-role")
+        .description("Change a member's role (owner|admin|member|guest) — promotes OR demotes. " +
+        "<target> may be an email, a prs_ personUid, or a full membership key. " +
+        "Owner-or-admin only; setting a target to owner (or changing an owner) is owner-only. Server-enforced.")
+        .action(async (target, newRole) => {
         try {
+            const role = newRole.trim().toLowerCase();
+            if (!VALID_ROLES.has(role)) {
+                console.error(chalk.red(`Invalid role '${newRole}': must be one of owner, admin, member, guest`));
+                process.exit(1);
+            }
             const token = await ensureCognitoToken();
             const companySlug = members.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            await setMemberRole(token, companyUid, membershipKey, role);
-            console.log(chalk.green(`Updated role for '${membershipKey}' to ${role}`));
+            const membershipKey = resolveRevokeTargetToMembershipKey(target, companyUid);
+            await changeMemberRole(token, companyUid, membershipKey, role);
+            console.log(chalk.green(`Updated role for '${target}' to ${role}`));
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
@@ -422,43 +457,66 @@ export function registerMembersCommand(program) {
     });
     members
         .command("list")
-        .description("List pending invites for the company")
-        .action(async () => {
+        .description("List the company's active members (use --pending for pending invites)")
+        .option("--pending", "List pending invites instead of active members")
+        .action(async (opts) => {
         try {
             const token = await ensureCognitoToken();
             const companySlug = members.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            const invites = await listPendingInvites(token, companyUid);
-            if (invites.length === 0) {
-                console.log(chalk.gray("No pending invites for this company."));
+            if (opts.pending) {
+                // --pending: preserve the original pending-invites view verbatim.
+                const invites = await listPendingInvites(token, companyUid);
+                if (invites.length === 0) {
+                    console.log(chalk.gray("No pending invites for this company."));
+                    return;
+                }
+                const targetW = Math.max(6, ...invites.map((i) => (i.inviteeEmail ?? i.personUid ?? "").length));
+                const roleW = Math.max(4, ...invites.map((i) => i.role.length));
+                const byW = Math.max(10, ...invites.map((i) => i.invitedBy.length));
+                const keyW = Math.max(14, ...invites.map((i) => i.membershipKey.length));
+                console.log(chalk.bold([
+                    "TARGET".padEnd(targetW),
+                    "ROLE".padEnd(roleW),
+                    "INVITED_BY".padEnd(byW),
+                    "INVITED_AT",
+                    "MEMBERSHIP_KEY".padEnd(keyW),
+                ].join("  ")));
+                for (const inv of invites) {
+                    const target = inv.inviteeEmail ?? inv.personUid ?? "";
+                    console.log([
+                        target.padEnd(targetW),
+                        inv.role.padEnd(roleW),
+                        inv.invitedBy.padEnd(byW),
+                        shortDate(inv.invitedAt),
+                        inv.membershipKey.padEnd(keyW),
+                    ].join("  "));
+                }
+                return;
+            }
+            // Default: list ACTIVE members so their emails drop straight into
+            // `hq secrets share <path> --with <email>`.
+            const activeMembers = await listActiveMembers(token, companyUid);
+            if (activeMembers.length === 0) {
+                console.log(chalk.gray("No active members found for this company."));
                 return;
             }
-            const targetW = Math.max(6, ...invites.map((i) => (i.inviteeEmail ?? i.personUid ?? "").length));
-            const roleW = Math.max(4, ...invites.map((i) => i.role.length));
-            const byW = Math.max(10, ...invites.map((i) => i.invitedBy.length));
-            const keyW = Math.max(14, ...invites.map((i) => i.membershipKey.length));
-            console.log(chalk.bold([
-                "TARGET".padEnd(targetW),
-                "ROLE".padEnd(roleW),
-                "INVITED_BY".padEnd(byW),
-                "INVITED_AT",
-                "MEMBERSHIP_KEY".padEnd(keyW),
-            ].join("  ")));
-            for (const inv of invites) {
-                const target = inv.inviteeEmail ?? inv.personUid ?? "";
-                console.log([
-                    target.padEnd(targetW),
-                    inv.role.padEnd(roleW),
-                    inv.invitedBy.padEnd(byW),
-                    shortDate(inv.invitedAt),
-                    inv.membershipKey.padEnd(keyW),
-                ].join("  "));
+            const emailW = Math.max(5, ...activeMembers.map((m) => (m.personEmail ?? m.personUid).length));
+            const roleW = Math.max(4, ...activeMembers.map((m) => m.role.length));
+            console.log(chalk.bold(["EMAIL".padEnd(emailW), "ROLE".padEnd(roleW), "NAME"].join("  ")));
+            for (const m of activeMembers) {
+                const email = m.personEmail ?? m.personUid;
+                const name = m.personName ?? m.personSlug ?? "";
+                console.log([email.padEnd(emailW), m.role.padEnd(roleW), name].join("  "));
             }
+            console.log(chalk.gray("Share a secret with a member: hq secrets share <path> --with <email>"));
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
                 const msg = err.status === 403
-                    ? "Not authorized — only admins and owners can list invites"
+                    ? opts.pending
+                        ? "Not authorized — only admins and owners can list invites"
+                        : "Not authorized — only company members can list members"
                     : formatInviteHttpError(err.status, err.message);
                 console.error(chalk.red(msg));
                 process.exit(1);
@@ -497,4 +555,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=40f5379c-742e-5cd5-aba2-931856dc7dd3
+//# debugId=83a54ed2-3f52-5b6f-a784-09f78f488ddd

package/dist/commands/people.d.ts

@@ -11,6 +11,16 @@
  * named by `--company`); nothing reads across company boundaries.
  */
 import { Command } from "commander";
+import { resolveNameToEmail, type PersonRecord } from "../utils/people.js";
+export type RefreshPeopleRoster = (hqRoot: string, companySlug: string) => Promise<void>;
+interface PeopleCommandDeps {
+    refreshRoster?: RefreshPeopleRoster;
+}
+interface PeopleLookupOpts {
+    localOnly?: boolean;
+    json?: boolean;
+}
+export declare function refreshPeopleRosterFromCloud(hqRoot: string, companySlug: string): Promise<void>;
 /**
  * Resolve the single company to operate on. Explicit `--company` always wins
  * (after a path-safety check). Otherwise the active company is inferred from
@@ -18,5 +28,20 @@ import { Command } from "commander";
  * do, the caller must disambiguate with `--company`.
  */
 export declare function resolveCompanySlug(hqRoot: string, explicit: string | undefined): string;
-export declare function registerPeopleCommand(program: Command): void;
+export declare function resolvePersonWithRosterFallback(input: {
+    hqRoot: string;
+    slug: string;
+    name: string;
+    opts?: PeopleLookupOpts;
+    refreshRoster?: RefreshPeopleRoster;
+}): Promise<ReturnType<typeof resolveNameToEmail>>;
+export declare function searchPeopleWithRosterFallback(input: {
+    hqRoot: string;
+    slug: string;
+    keyword: string;
+    opts?: PeopleLookupOpts;
+    refreshRoster?: RefreshPeopleRoster;
+}): Promise<PersonRecord[]>;
+export declare function registerPeopleCommand(program: Command, deps?: PeopleCommandDeps): void;
+export {};
 //# sourceMappingURL=people.d.ts.map

package/dist/commands/people.js

@@ -11,14 +11,31 @@
  * named by `--company`); nothing reads across company boundaries.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="076b7f64-6626-5733-8992-ab9361a3e31d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="79abc1f5-4f5a-5c95-b29b-10f04417355f")}catch(e){}}();
 import * as fs from "fs";
 import { Option } from "commander";
 import chalk from "chalk";
+import { VaultClient } from "@indigoai-us/hq-cloud";
 import * as yaml from "js-yaml";
 import { findHqRoot } from "../utils/manifest.js";
 import { manifestPath } from "./cloud-provision.js";
+import { DEFAULT_COGNITO, buildVaultConfig, ensureCognitoToken, } from "../utils/cognito-session.js";
+import { getCompanyUid } from "../utils/vault-api.js";
+import { createCompanyPresignClient, runGet } from "./files-browse.js";
 import { assertSafeCompanySlug, listCompanyPeople, searchPeople, resolveNameToEmail, companyPeopleDir, } from "../utils/people.js";
+export async function refreshPeopleRosterFromCloud(hqRoot, companySlug) {
+    const accessToken = await ensureCognitoToken();
+    const client = new VaultClient(buildVaultConfig(accessToken));
+    await getCompanyUid(accessToken, companySlug);
+    await runGet({
+        path: `companies/${companySlug}/people/`,
+        hqRoot,
+        companySlug,
+        vaultClient: client,
+        companyClient: ({ companyUid }) => createCompanyPresignClient({ token: accessToken, companyUid }),
+        region: DEFAULT_COGNITO.region,
+    });
+}
 /** Companies that still exist (anything not explicitly `status: archived`). */
 function activeCompanySlugs(manifest) {
     const companies = manifest.companies ?? {};
@@ -86,7 +103,39 @@ function fail(message) {
     console.error(chalk.red(message));
     process.exit(1);
 }
-export function registerPeopleCommand(program) {
+function logRefreshFailure(companySlug, err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(chalk.dim(`  Could not refresh people roster for '${companySlug}': ${message}`));
+}
+async function tryRefreshRoster(refreshRoster, hqRoot, slug) {
+    try {
+        await refreshRoster(hqRoot, slug);
+        return true;
+    }
+    catch (err) {
+        logRefreshFailure(slug, err);
+        return false;
+    }
+}
+export async function resolvePersonWithRosterFallback(input) {
+    const local = resolveNameToEmail(listCompanyPeople(input.hqRoot, input.slug), input.name);
+    if (local.status !== "not_found" || input.opts?.localOnly)
+        return local;
+    const refreshed = await tryRefreshRoster(input.refreshRoster ?? refreshPeopleRosterFromCloud, input.hqRoot, input.slug);
+    if (!refreshed)
+        return local;
+    return resolveNameToEmail(listCompanyPeople(input.hqRoot, input.slug), input.name);
+}
+export async function searchPeopleWithRosterFallback(input) {
+    const local = searchPeople(listCompanyPeople(input.hqRoot, input.slug), input.keyword);
+    if (local.length > 0 || input.opts?.localOnly)
+        return local;
+    const refreshed = await tryRefreshRoster(input.refreshRoster ?? refreshPeopleRosterFromCloud, input.hqRoot, input.slug);
+    if (!refreshed)
+        return local;
+    return searchPeople(listCompanyPeople(input.hqRoot, input.slug), input.keyword);
+}
+export function registerPeopleCommand(program, deps = {}) {
     const people = program
         .command("people")
         .description("List, search, and resolve a company's people (from companies/<co>/people)")
@@ -122,12 +171,19 @@ export function registerPeopleCommand(program) {
         .command("search <keyword>")
         .description("Keyword search over people names and emails")
         .option("--json", "Output JSON instead of a table")
-        .action((keyword, opts) => {
+        .option("--local-only", "Skip cloud fallback; search only the local people roster")
+        .action(async (keyword, opts) => {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
             const slug = resolveCompanySlug(hqRoot, scope.company);
-            const matches = searchPeople(listCompanyPeople(hqRoot, slug), keyword);
+            const matches = await searchPeopleWithRosterFallback({
+                hqRoot,
+                slug,
+                keyword,
+                opts,
+                refreshRoster: deps.refreshRoster,
+            });
             if (opts.json) {
                 console.log(JSON.stringify(matches, null, 2));
                 return;
@@ -146,12 +202,19 @@ export function registerPeopleCommand(program) {
         .command("resolve <name>")
         .description("Resolve a person name to their email address")
         .option("--json", "Output JSON instead of plain text")
-        .action((name, opts) => {
+        .option("--local-only", "Skip cloud fallback; resolve only from the local people roster")
+        .action(async (name, opts) => {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
             const slug = resolveCompanySlug(hqRoot, scope.company);
-            const result = resolveNameToEmail(listCompanyPeople(hqRoot, slug), name);
+            const result = await resolvePersonWithRosterFallback({
+                hqRoot,
+                slug,
+                name,
+                opts,
+                refreshRoster: deps.refreshRoster,
+            });
             if (opts.json) {
                 console.log(JSON.stringify(result, null, 2));
                 if (result.status === "found")
@@ -184,4 +247,4 @@ export function registerPeopleCommand(program) {
     });
 }
 //# sourceMappingURL=people.js.map
-//# debugId=076b7f64-6626-5733-8992-ab9361a3e31d
+//# debugId=79abc1f5-4f5a-5c95-b29b-10f04417355f

package/dist/commands/secrets-scope.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Pure helpers describing WHICH secrets scope a command acted on, so `set` and
+ * `list` can echo it. Users were setting a secret in one scope (personal vs a
+ * company, or company A vs B) and listing another, then seeing "no secrets" with
+ * no indication the scopes differed (feedback_70e059da).
+ */
+export interface SecretsScopeRef {
+    /** True when --personal was used (caller's personal vault). */
+    personal: boolean;
+    /** The slug the user passed via --company, if any. */
+    companySlug?: string;
+    /** Resolved entity uid: prs_* for personal, cmp_* for a company. */
+    companyUid: string;
+}
+/** Human label for a secrets scope: "your personal vault" or "company <slug-or-uid>". */
+export declare function describeSecretsScope(ref: SecretsScopeRef): string;
+export declare function formatSecretSaved(name: string, scope: string): string;
+export declare function formatSecretsListHeader(scope: string): string;
+export declare function formatSecretsListEmpty(scope: string): string;
+//# sourceMappingURL=secrets-scope.d.ts.map

package/dist/commands/secrets-scope.js

@@ -0,0 +1,19 @@
+/** Human label for a secrets scope: "your personal vault" or "company <slug-or-uid>". */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="718913a3-f80f-5bff-928e-a7aa9f51dd0d")}catch(e){}}();
+export function describeSecretsScope(ref) {
+    if (ref.personal)
+        return "your personal vault";
+    return `company ${ref.companySlug ?? ref.companyUid}`;
+}
+export function formatSecretSaved(name, scope) {
+    return `Secret '${name}' saved to ${scope}.`;
+}
+export function formatSecretsListHeader(scope) {
+    return `Secrets for ${scope}:`;
+}
+export function formatSecretsListEmpty(scope) {
+    return `No secrets found for ${scope}.`;
+}
+//# sourceMappingURL=secrets-scope.js.map
+//# debugId=718913a3-f80f-5bff-928e-a7aa9f51dd0d

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3049e431-c5db-5430-90fe-82866c35e95b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="96461f1a-6d5b-5dc0-b00a-0a9fa30a0dad")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -8,6 +8,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
+import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 function scopeOpts(opts) {
@@ -344,7 +345,13 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const token = await ensureCognitoToken();
-            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const scope = scopeOpts(secrets.opts());
+            const companyUid = await getEntityUid(token, scope);
+            const scopeLabel = describeSecretsScope({
+                personal: scope.personal,
+                companySlug: scope.companySlug,
+                companyUid,
+            });
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}`,
@@ -357,7 +364,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             removeCacheEntry(companyUid, name);
-            console.log(chalk.green(`Secret '${name}' saved.`));
+            console.log(chalk.green(formatSecretSaved(name, scopeLabel)));
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -487,7 +494,13 @@ export function registerSecretsCommand(program) {
                 normalizedPrefix = normalized;
             }
             const token = await ensureCognitoToken();
-            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
+            const scope = scopeOpts(secrets.opts());
+            const companyUid = await getEntityUid(token, scope);
+            const scopeLabel = describeSecretsScope({
+                personal: scope.personal,
+                companySlug: scope.companySlug,
+                companyUid,
+            });
             const query = {};
             if (normalizedPrefix) {
                 query.prefix = normalizedPrefix;
@@ -504,7 +517,7 @@ export function registerSecretsCommand(program) {
             }
             const data = (await res.json());
             if (data.secrets.length === 0) {
-                console.log(chalk.dim("No secrets found."));
+                console.log(chalk.dim(formatSecretsListEmpty(scopeLabel)));
                 return;
             }
             const nameWidth = Math.max(4, ...data.secrets.map((s) => s.name.length));
@@ -514,6 +527,7 @@ export function registerSecretsCommand(program) {
             if (hasPermission) {
                 const accessWidth = Math.max(6, ...data.secrets.map((s) => (s.permission ?? "-").length));
                 const header = `${"NAME".padEnd(nameWidth)}  ${"ACCESS".padEnd(accessWidth)}  ${"TIER".padEnd(tierWidth)}  ${"SCRIPT LOCK".padEnd(scriptLockWidth)}  LAST MODIFIED`;
+                console.log(chalk.dim(formatSecretsListHeader(scopeLabel)));
                 console.log(chalk.bold(header));
                 for (const s of data.secrets) {
                     const access = s.permission ?? "-";
@@ -525,6 +539,7 @@ export function registerSecretsCommand(program) {
             }
             else {
                 const header = `${"NAME".padEnd(nameWidth)}  ${"TIER".padEnd(tierWidth)}  ${"SCRIPT LOCK".padEnd(scriptLockWidth)}  LAST MODIFIED`;
+                console.log(chalk.dim(formatSecretsListHeader(scopeLabel)));
                 console.log(chalk.bold(header));
                 for (const s of data.secrets) {
                     const tier = normalizeSecretTier(s.tier);
@@ -1148,4 +1163,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=3049e431-c5db-5430-90fe-82866c35e95b
+//# debugId=96461f1a-6d5b-5dc0-b00a-0a9fa30a0dad