@indigoai-us/hq-cli 5.52.0 → 5.53.1

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 ## [Unreleased]
 
+## [5.53.1]
+
+### Changed
+
+- **`hq members promote` now clarifies admin access.** Promoting someone to
+  `owner` or `admin` prints that they automatically have full read and write
+  access to all of the company's context — there is no separate context grant to
+  give them (owners/admins resolve to full access via the server-side role
+  bypass) — and that what they actually see synced locally is governed by their
+  sync mode (`hq sync mode`), not by access. Member/guest promotions are
+  unchanged.
+
+## [5.53.0]
+
+### Added
+
+- **`hq crm entity upsert` — write a client record into the native CRM from the
+  terminal.** Posts to `POST /crm/entities`, which runs through the ontology
+  write-gate (tenant-isolated, `crmEnabled`-gated) and refreshes the company's
+  CRM projection. `--company`, `--type` (`contact|deal|contract|invoice|company`)
+  and `--name` are required in flag form; `--attio-id|--stripe-id|--pandadoc-id|
+  --neon-id` populate `external_ids`; `--json <file|->` passes a full entity or
+  array instead. Surfaces a `CRM_DISABLED` 403 with an enable hint. This is the
+  build-native path for companies with no external CRM.
+- **`hq company settings set` — toggle company settings from the CLI.** Calls
+  `PUT /company-settings` with `--crm-enabled <true|false>` and/or
+  `--ontology-enabled <true|false>` (at least one required; owner-gated
+  server-side). `--crm-enabled true` is how `/crm-setup` activates the native
+  CRM for a company.
+
 ## [5.52.0]
 
 ### Added

package/dist/commands/company.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerCompanyCommand(program: Command): void;
+//# sourceMappingURL=company.d.ts.map

package/dist/commands/company.js

@@ -0,0 +1,82 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c0b7f9ed-8ddb-5422-8872-f85b6b406af6")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
+/**
+ * Parse a `--flag <true|false>` string into a boolean, or throw. Commander
+ * passes the raw string; we validate strictly so a typo never silently writes
+ * the wrong value.
+ */
+function parseBoolFlag(value, flag) {
+    const v = value.trim().toLowerCase();
+    if (v === "true")
+        return true;
+    if (v === "false")
+        return false;
+    throw new Error(`${flag} must be 'true' or 'false' (got '${value}')`);
+}
+export function registerCompanyCommand(program) {
+    const company = program
+        .command("company")
+        .description("Company-level settings")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    const settings = company
+        .command("settings")
+        .description("Per-company settings (owner-only)");
+    settings
+        .command("set")
+        .description("Set per-company settings (PUT /company-settings). Require at least one " +
+        "of --crm-enabled / --ontology-enabled.")
+        .option("--crm-enabled <true|false>", "Enable/disable the native CRM for this company")
+        .option("--ontology-enabled <true|false>", "Enable/disable the ontology gardener for this company")
+        .action(async (opts) => {
+        try {
+            const companySlug = company.opts().company;
+            if (!companySlug) {
+                console.error(chalk.red("Error: --company <slug> is required."));
+                process.exit(1);
+            }
+            if (opts.crmEnabled === undefined && opts.ontologyEnabled === undefined) {
+                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled."));
+                process.exit(1);
+            }
+            const body = {};
+            if (opts.crmEnabled !== undefined) {
+                body.crmEnabled = parseBoolFlag(opts.crmEnabled, "--crm-enabled");
+            }
+            if (opts.ontologyEnabled !== undefined) {
+                body.ontologyEnabled = parseBoolFlag(opts.ontologyEnabled, "--ontology-enabled");
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, { companySlug });
+            body.companyUid = companyUid;
+            const res = await vaultApiFetch({
+                token,
+                path: "/company-settings",
+                method: "PUT",
+                body,
+            });
+            if (!res.ok) {
+                const errBody = (await res.json().catch(() => ({})));
+                if (res.status === 403) {
+                    console.error(chalk.red("Requires owner role on this company to change its settings."));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`Failed to update company settings: ${errBody.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            const applied = Object.entries(body)
+                .filter(([k]) => k !== "companyUid")
+                .map(([k, v]) => `${k}=${v}`)
+                .join(", ");
+            console.log(chalk.green(`Company settings updated for ${companySlug}: ${applied}`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=company.js.map
+//# debugId=c0b7f9ed-8ddb-5422-8872-f85b6b406af6

package/dist/commands/crm.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerCrmCommand(program: Command): void;
+//# sourceMappingURL=crm.d.ts.map

package/dist/commands/crm.js

@@ -0,0 +1,162 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="056ad757-a0da-5318-b97f-21ae6529f648")}catch(e){}}();
+import chalk from "chalk";
+import { readFileSync } from "node:fs";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
+/**
+ * `hq crm entity upsert` — agent-facing controlled entity upsert
+ * (hq-native-crm US-002). Wraps `POST /crm/entities`, which fronts the ontology
+ * write gate so an authenticated company MEMBER (or higher) can create/update
+ * canonical CRM entities in their company's vault.
+ *
+ * Conventions mirror `secrets.ts`: ensureCognitoToken() → getEntityUid() →
+ * vaultApiFetch() → error-check → chalk output.
+ */
+/** The CRM/ontology entity types the upsert route accepts via `--type`. */
+const CRM_ENTITY_TYPES = [
+    "contact",
+    "deal",
+    "contract",
+    "invoice",
+    "company",
+];
+/**
+ * Read the `--json <file|->` payload: a single entity object or an array of
+ * entities. `-` reads from stdin. Returns the entities array (always
+ * normalized to an array) or throws a descriptive Error.
+ */
+function readJsonEntities(source) {
+    const raw = source === "-"
+        ? readFileSync(0, "utf8") // fd 0 = stdin
+        : readFileSync(source, "utf8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`--json payload is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const entities = Array.isArray(parsed) ? parsed : [parsed];
+    if (entities.length === 0) {
+        throw new Error("--json payload contained no entities");
+    }
+    for (const e of entities) {
+        if (!e || typeof e !== "object") {
+            throw new Error("--json entities must be objects");
+        }
+        const obj = e;
+        if (typeof obj.type !== "string" || typeof obj.canonical_name !== "string") {
+            throw new Error("each --json entity needs a string `type` and `canonical_name`");
+        }
+    }
+    return entities;
+}
+/**
+ * Build a single entity from the flag form (`--type` + `--name` + optional
+ * external-id flags). The route fills the additive defaults (aliases/domain/
+ * relationships/confidence) when omitted, but we send a complete minimal shape.
+ */
+function buildEntityFromFlags(opts) {
+    const externalIds = {};
+    if (opts.attioId)
+        externalIds.attio = opts.attioId;
+    if (opts.stripeId)
+        externalIds.stripe = opts.stripeId;
+    if (opts.pandadocId)
+        externalIds.pandadoc = opts.pandadocId;
+    if (opts.neonId)
+        externalIds.neon = opts.neonId;
+    const entity = {
+        type: opts.type,
+        canonical_name: opts.name,
+        aliases: [],
+        confidence: 1,
+        domain: [],
+        relationships: [],
+    };
+    if (Object.keys(externalIds).length > 0) {
+        entity.external_ids = externalIds;
+    }
+    return entity;
+}
+export function registerCrmCommand(program) {
+    const crm = program
+        .command("crm")
+        .description("Native CRM — upsert canonical entities into a company vault")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    const entity = crm
+        .command("entity")
+        .description("CRM entity operations");
+    entity
+        .command("upsert")
+        .description("Create or update a canonical CRM entity (POST /crm/entities). " +
+        "Use --type/--name (+ optional external-id flags) or --json <file|-> " +
+        "to pass a full entity/array.")
+        .option("--type <type>", `Entity type: ${CRM_ENTITY_TYPES.join(" | ")}`)
+        .option("--name <canonical_name>", "Canonical entity name")
+        .option("--attio-id <id>", "Attio record id → external_ids.attio")
+        .option("--stripe-id <id>", "Stripe object id → external_ids.stripe")
+        .option("--pandadoc-id <id>", "PandaDoc document id → external_ids.pandadoc")
+        .option("--neon-id <id>", "Neon row id → external_ids.neon")
+        .option("--json <file|->", "Path to a JSON file (or '-' for stdin) with a full entity object or array")
+        .action(async (opts) => {
+        try {
+            const companySlug = crm.opts().company;
+            if (!companySlug) {
+                console.error(chalk.red("Error: --company <slug> is required."));
+                process.exit(1);
+            }
+            // Resolve the entity payload: --json is the alternative to flags.
+            let entities;
+            if (opts.json) {
+                entities = readJsonEntities(opts.json);
+            }
+            else {
+                if (!opts.type) {
+                    console.error(chalk.red(`Error: --type <${CRM_ENTITY_TYPES.join("|")}> is required (or pass --json).`));
+                    process.exit(1);
+                }
+                if (!CRM_ENTITY_TYPES.includes(opts.type)) {
+                    console.error(chalk.red(`Error: --type must be one of ${CRM_ENTITY_TYPES.join(", ")}.`));
+                    process.exit(1);
+                }
+                if (!opts.name) {
+                    console.error(chalk.red("Error: --name <canonical_name> is required (or pass --json)."));
+                    process.exit(1);
+                }
+                entities = [buildEntityFromFlags(opts)];
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, { companySlug });
+            const res = await vaultApiFetch({
+                token,
+                path: "/crm/entities",
+                method: "POST",
+                body: { companyUid, entities },
+            });
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                // CrmDisabledError surfaces as a 403 with a helpful message.
+                if (res.status === 403 && body.code === "CRM_DISABLED") {
+                    console.error(chalk.red("CRM is not enabled for this company. Enable it first: " +
+                        `hq company settings set --company ${companySlug} --crm-enabled true`));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`Failed to upsert entities: ${body.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            const result = (await res.json().catch(() => ({})));
+            console.log(chalk.green(`Upsert ${result.status ?? "ok"}: ` +
+                `${result.created ?? 0} created, ` +
+                `${result.updated ?? 0} updated, ` +
+                `${result.skipped ?? 0} skipped.`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=crm.js.map
+//# debugId=056ad757-a0da-5318-b97f-21ae6529f648

package/dist/commands/files.d.ts

@@ -66,6 +66,8 @@ interface RunFilesDeleteParams {
     prefix: string;
     dryRun: boolean;
     yes: boolean;
+    /** Target the caller's personal vault instead of a company vault. */
+    personal?: boolean;
     companySlug: string | undefined;
 }
 /**

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fc999359-c426-5277-ba96-5452ae1ed2e2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="af29c08f-dbeb-5406-8deb-fdc263354b4a")}catch(e){}}();
 import chalk from "chalk";
 import open from "open";
 import * as readline from "node:readline";
@@ -356,16 +356,24 @@ export function registerFilesCommand(program) {
     });
     files
         .command("delete <prefix>")
-        .description("Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes.")
+        .description("Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.")
         .option("--dry-run", "List what WOULD be deleted without deleting anything")
+        .option("--personal", "Target your own personal vault instead of a company vault (mutually exclusive with --company)")
         .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
         .action(async (prefix, opts) => {
         try {
+            const companySlug = files.opts().company;
+            const personal = opts.personal === true;
+            if (personal && companySlug) {
+                console.error(chalk.red("Pass either --personal or --company, not both."));
+                process.exit(1);
+            }
             await runFilesDelete({
                 prefix,
                 dryRun: opts.dryRun === true,
                 yes: opts.yes === true,
-                companySlug: files.opts().company,
+                personal,
+                companySlug,
             });
         }
         catch (err) {
@@ -563,17 +571,28 @@ function realConfirm(message) {
 /**
  * POST /v1/files/delete. Throws FilesDeleteHttpError on any non-2xx so the one
  * caller renders a single consistent error path.
+ *
+ * Scope is EITHER a company vault (`companyUid` set) OR the caller's personal
+ * vault (`personal: true`). For the personal case the server resolves the target
+ * person + bucket from the authenticated caller — we send NO uid, just the
+ * `personal` flag — so there is nothing for the client to get wrong or spoof.
  */
 async function callDeleteEndpoint(params) {
     const res = await vaultApiFetch({
         token: params.token,
         path: "/v1/files/delete",
         method: "POST",
-        body: {
-            company: params.companyUid,
-            prefix: params.prefix,
-            dryRun: params.dryRun,
-        },
+        body: params.personal
+            ? {
+                personal: true,
+                prefix: params.prefix,
+                dryRun: params.dryRun,
+            }
+            : {
+                company: params.companyUid,
+                prefix: params.prefix,
+                dryRun: params.dryRun,
+            },
     });
     if (!res.ok) {
         const body = (await res.json().catch(() => ({})));
@@ -642,14 +661,21 @@ export async function runFilesDelete(params, deps = {}) {
         process.exit(1);
     }
     const token = await ensureCognitoToken();
-    const companyUid = await getCompanyUid(token, params.companySlug);
+    // Personal scope resolves the vault server-side from the caller's identity —
+    // no company to look up. Company scope resolves the companyUid as before.
+    const companyUid = params.personal
+        ? undefined
+        : await getCompanyUid(token, params.companySlug);
+    const scopeArgs = params.personal
+        ? { personal: true }
+        : { companyUid };
     // 1. Always preview first — this is how we print the EXACT key count before
     //    deleting anything (and the whole behavior of --dry-run).
     let preview;
     try {
         preview = await callDeleteEndpoint({
             token,
-            companyUid,
+            ...scopeArgs,
             prefix: normalized,
             dryRun: true,
         });
@@ -682,7 +708,9 @@ export async function runFilesDelete(params, deps = {}) {
         console.log(chalk.dim(`  (${preview.skipped} more under this prefix you can't delete will be left untouched)`));
     }
     if (!params.yes) {
-        const ok = await confirm(`Delete ${preview.matched} ${noun}? This removes them from the shared vault for everyone.`);
+        const ok = await confirm(params.personal
+            ? `Delete ${preview.matched} ${noun}? This removes them from your personal vault.`
+            : `Delete ${preview.matched} ${noun}? This removes them from the shared vault for everyone.`);
         if (!ok) {
             console.log(chalk.dim("Aborted — nothing was deleted."));
             return;
@@ -693,7 +721,7 @@ export async function runFilesDelete(params, deps = {}) {
     try {
         result = await callDeleteEndpoint({
             token,
-            companyUid,
+            ...scopeArgs,
             prefix: normalized,
             dryRun: false,
         });
@@ -712,4 +740,4 @@ export async function runFilesDelete(params, deps = {}) {
     }
 }
 //# sourceMappingURL=files.js.map
-//# debugId=fc999359-c426-5277-ba96-5452ae1ed2e2
+//# debugId=af29c08f-dbeb-5406-8deb-fdc263354b4a

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="83a54ed2-3f52-5b6f-a784-09f78f488ddd")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c844265d-9140-55ac-8fc7-c0b2a049a0af")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -316,6 +316,15 @@ export function registerMembersCommand(program) {
             const membershipKey = resolveRevokeTargetToMembershipKey(target, companyUid);
             await changeMemberRole(token, companyUid, membershipKey, role);
             console.log(chalk.green(`Updated role for '${target}' to ${role}`));
+            if (role === "owner" || role === "admin") {
+                // Clarify the common confusion: owners/admins already get full
+                // access to ALL company context automatically via the role bypass
+                // (hq-pro resolveEffectivePermission) — there is no separate context
+                // grant to give them. What they SEE locally is governed by their sync
+                // mode, not by access.
+                console.log(chalk.dim(`${role === "owner" ? "Owners" : "Admins"} automatically have full read and write access to all of this company's context — no separate context grant is needed.\n` +
+                    `What they actually see synced to their machine is governed by their sync mode (\`hq sync mode\`), not by access.`));
+            }
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
@@ -555,4 +564,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=83a54ed2-3f52-5b6f-a784-09f78f488ddd
+//# debugId=c844265d-9140-55ac-8fc7-c0b2a049a0af

package/dist/index.js

@@ -5,7 +5,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="82c44c14-a953-5644-9bf2-dd2c6d487d63")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6ad01242-c165-5be2-bb31-e929c0b38f5e")}catch(e){}}();
 import "./node-preflight.js";
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
@@ -48,6 +48,8 @@ import { registerSignalsCommand } from "./commands/signals.js";
 import { registerReindexCommand } from "./commands/reindex.js";
 import { registerRescueCommand } from "./commands/rescue.js";
 import { registerMcpCommand } from "./commands/mcp-status.js";
+import { registerCrmCommand } from "./commands/crm.js";
+import { registerCompanyCommand } from "./commands/company.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { isEpipe } from "./utils/epipe.js";
@@ -173,6 +175,13 @@ registerRescueCommand(program);
 // provenance-based status across BOTH Claude + Codex runtimes (reads `_hqPack`
 // off the configs, NOT linkStatus), with secret-redacted output + `--json`.
 registerMcpCommand(program);
+// Native CRM entity upsert (subcommand group — `hq crm entity upsert`). Wraps
+// POST /crm/entities (the ontology write gate) so an authenticated company
+// member can create/update canonical CRM entities in the company vault.
+registerCrmCommand(program);
+// Company settings (subcommand group — `hq company settings set`). Owner-only
+// toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
+registerCompanyCommand(program);
 (async () => {
     try {
         Sentry.addBreadcrumb({
@@ -233,4 +242,4 @@ registerMcpCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=82c44c14-a953-5644-9bf2-dd2c6d487d63
+//# debugId=6ad01242-c165-5be2-bb31-e929c0b38f5e

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.52.0",
+  "version": "5.53.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/company.test.ts

@@ -0,0 +1,177 @@
+/**
+ * Unit tests for `hq company settings set` (company.ts).
+ *
+ * Mirrors members.test.ts: mock ensureCognitoToken + getEntityUid, spy on
+ * global fetch, drive through a Commander program, assert the PUT
+ * /company-settings request shape + exit behavior.
+ */
+
+import { Command } from "commander";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import("../utils/cognito-session.js")>();
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = await importOriginal<typeof import("../utils/vault-api.js")>();
+  return {
+    ...original,
+    getEntityUid: vi.fn(async () => "cmp_acme"),
+  };
+});
+
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { getEntityUid } from "../utils/vault-api.js";
+import { registerCompanyCommand } from "./company.js";
+
+function jsonResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+let fetchSpy: MockInstance<typeof fetch>;
+let exitSpy: MockInstance<typeof process.exit>;
+const mockEnsureCognitoToken = vi.mocked(ensureCognitoToken);
+const mockGetEntityUid = vi.mocked(getEntityUid);
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  fetchSpy = vi.spyOn(globalThis, "fetch");
+  mockEnsureCognitoToken.mockResolvedValue("test-token");
+  mockGetEntityUid.mockResolvedValue("cmp_acme");
+  exitSpy = vi
+    .spyOn(process, "exit")
+    .mockImplementation((code?: number) => {
+      throw new Error(`process.exit(${code})`);
+    }) as unknown as MockInstance<typeof process.exit>;
+  vi.spyOn(console, "log").mockImplementation(() => {});
+  vi.spyOn(console, "error").mockImplementation(() => {});
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.name("hq").exitOverride();
+  registerCompanyCommand(program);
+  return program;
+}
+
+async function run(args: string[]): Promise<void> {
+  await buildProgram().parseAsync(["node", "hq", ...args]);
+}
+
+describe("hq company settings set", () => {
+  it("PUTs crmEnabled=true with the resolved companyUid", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { companySettings: { crmEnabled: true } }),
+    );
+
+    await run([
+      "company",
+      "settings",
+      "set",
+      "--company",
+      "acme",
+      "--crm-enabled",
+      "true",
+    ]);
+
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/company-settings");
+    expect(init?.method).toBe("PUT");
+    const sent = JSON.parse(init?.body as string);
+    expect(sent).toMatchObject({ companyUid: "cmp_acme", crmEnabled: true });
+    expect(sent.ontologyEnabled).toBeUndefined();
+  });
+
+  it("PUTs both flags when both are supplied", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+
+    await run([
+      "company",
+      "settings",
+      "set",
+      "--company",
+      "acme",
+      "--crm-enabled",
+      "false",
+      "--ontology-enabled",
+      "true",
+    ]);
+
+    const sent = JSON.parse(fetchSpy.mock.calls[0][1]?.body as string);
+    expect(sent).toMatchObject({
+      companyUid: "cmp_acme",
+      crmEnabled: false,
+      ontologyEnabled: true,
+    });
+  });
+
+  it("requires at least one flag", async () => {
+    await expect(
+      run(["company", "settings", "set", "--company", "acme"]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("requires --company", async () => {
+    await expect(
+      run(["company", "settings", "set", "--crm-enabled", "true"]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("rejects a non-boolean flag value", async () => {
+    await expect(
+      run([
+        "company",
+        "settings",
+        "set",
+        "--company",
+        "acme",
+        "--crm-enabled",
+        "yes",
+      ]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("exits 1 on a 403 (non-owner)", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(403, { error: "Requires owner role", code: "FORBIDDEN" }),
+    );
+
+    await expect(
+      run([
+        "company",
+        "settings",
+        "set",
+        "--company",
+        "acme",
+        "--crm-enabled",
+        "true",
+      ]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+});