@indigoai-us/hq-cli 5.52.0 → 5.53.1

package/src/commands/files.ts

@@ -468,21 +468,39 @@ export function registerFilesCommand(program: Command): Command {
   files
     .command("delete <prefix>")
     .description(
-      "Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes.",
+      "Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.",
     )
     .option(
       "--dry-run",
       "List what WOULD be deleted without deleting anything",
     )
+    .option(
+      "--personal",
+      "Target your own personal vault instead of a company vault (mutually exclusive with --company)",
+    )
     .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
     .action(
-      async (prefix: string, opts: { dryRun?: boolean; yes?: boolean }) => {
+      async (
+        prefix: string,
+        opts: { dryRun?: boolean; yes?: boolean; personal?: boolean },
+      ) => {
         try {
+          const companySlug = files.opts().company as string | undefined;
+          const personal = opts.personal === true;
+          if (personal && companySlug) {
+            console.error(
+              chalk.red(
+                "Pass either --personal or --company, not both.",
+              ),
+            );
+            process.exit(1);
+          }
           await runFilesDelete({
             prefix,
             dryRun: opts.dryRun === true,
             yes: opts.yes === true,
-            companySlug: files.opts().company as string | undefined,
+            personal,
+            companySlug,
           });
         } catch (err) {
           console.error(
@@ -783,10 +801,16 @@ function realConfirm(message: string): Promise<boolean> {
 /**
  * POST /v1/files/delete. Throws FilesDeleteHttpError on any non-2xx so the one
  * caller renders a single consistent error path.
+ *
+ * Scope is EITHER a company vault (`companyUid` set) OR the caller's personal
+ * vault (`personal: true`). For the personal case the server resolves the target
+ * person + bucket from the authenticated caller — we send NO uid, just the
+ * `personal` flag — so there is nothing for the client to get wrong or spoof.
  */
 async function callDeleteEndpoint(params: {
   token: string;
-  companyUid: string;
+  companyUid?: string;
+  personal?: boolean;
   prefix: string;
   dryRun: boolean;
 }): Promise<FilesDeleteResponse> {
@@ -794,11 +818,17 @@ async function callDeleteEndpoint(params: {
     token: params.token,
     path: "/v1/files/delete",
     method: "POST",
-    body: {
-      company: params.companyUid,
-      prefix: params.prefix,
-      dryRun: params.dryRun,
-    },
+    body: params.personal
+      ? {
+          personal: true,
+          prefix: params.prefix,
+          dryRun: params.dryRun,
+        }
+      : {
+          company: params.companyUid,
+          prefix: params.prefix,
+          dryRun: params.dryRun,
+        },
   });
   if (!res.ok) {
     const body = (await res.json().catch(() => ({}))) as Record<string, string>;
@@ -815,6 +845,8 @@ interface RunFilesDeleteParams {
   prefix: string;
   dryRun: boolean;
   yes: boolean;
+  /** Target the caller's personal vault instead of a company vault. */
+  personal?: boolean;
   companySlug: string | undefined;
 }
 
@@ -896,7 +928,14 @@ export async function runFilesDelete(
   }
 
   const token = await ensureCognitoToken();
-  const companyUid = await getCompanyUid(token, params.companySlug);
+  // Personal scope resolves the vault server-side from the caller's identity —
+  // no company to look up. Company scope resolves the companyUid as before.
+  const companyUid = params.personal
+    ? undefined
+    : await getCompanyUid(token, params.companySlug);
+  const scopeArgs = params.personal
+    ? { personal: true as const }
+    : { companyUid };
 
   // 1. Always preview first — this is how we print the EXACT key count before
   //    deleting anything (and the whole behavior of --dry-run).
@@ -904,7 +943,7 @@ export async function runFilesDelete(
   try {
     preview = await callDeleteEndpoint({
       token,
-      companyUid,
+      ...scopeArgs,
       prefix: normalized,
       dryRun: true,
     });
@@ -956,7 +995,9 @@ export async function runFilesDelete(
 
   if (!params.yes) {
     const ok = await confirm(
-      `Delete ${preview.matched} ${noun}? This removes them from the shared vault for everyone.`,
+      params.personal
+        ? `Delete ${preview.matched} ${noun}? This removes them from your personal vault.`
+        : `Delete ${preview.matched} ${noun}? This removes them from the shared vault for everyone.`,
     );
     if (!ok) {
       console.log(chalk.dim("Aborted — nothing was deleted."));
@@ -969,7 +1010,7 @@ export async function runFilesDelete(
   try {
     result = await callDeleteEndpoint({
       token,
-      companyUid,
+      ...scopeArgs,
       prefix: normalized,
       dryRun: false,
     });

package/src/commands/members.test.ts

@@ -1051,11 +1051,21 @@ describe("registerMembersCommand promote", () => {
     expect(logSpy).toHaveBeenCalledWith(
       expect.stringContaining("Updated role for 'alice@example.com' to admin"),
     );
+    // Clarifies that admins already have full context access automatically
+    // (no separate grant) and that sync mode governs local visibility.
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining(
+        "Admins automatically have full read and write access",
+      ),
+    );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("governed by their sync mode"),
+    );
   });
 
   it("forwards a personUid target and the guest role (beyond set-role's admin|member cap)", async () => {
     fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    vi.spyOn(console, "log").mockImplementation(() => undefined);
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
 
     await buildMembersProgram().parseAsync(
       ["members", "--company", "acme", "promote", "prs_bob", "guest"],
@@ -1070,6 +1080,11 @@ describe("registerMembersCommand promote", () => {
       membershipKey: "prs_bob#cmp_acme",
       newRole: "guest",
     });
+    // The full-access clarification applies ONLY to the role-bypass roles
+    // (owner/admin) — a guest/member promotion must not claim full access.
+    expect(logSpy).not.toHaveBeenCalledWith(
+      expect.stringContaining("full read and write access"),
+    );
   });
 
   it("rejects an invalid role at the CLI and exits non-zero without a network call", async () => {

package/src/commands/members.ts

@@ -575,6 +575,19 @@ export function registerMembersCommand(program: Command): void {
         console.log(
           chalk.green(`Updated role for '${target}' to ${role}`),
         );
+        if (role === "owner" || role === "admin") {
+          // Clarify the common confusion: owners/admins already get full
+          // access to ALL company context automatically via the role bypass
+          // (hq-pro resolveEffectivePermission) — there is no separate context
+          // grant to give them. What they SEE locally is governed by their sync
+          // mode, not by access.
+          console.log(
+            chalk.dim(
+              `${role === "owner" ? "Owners" : "Admins"} automatically have full read and write access to all of this company's context — no separate context grant is needed.\n` +
+                `What they actually see synced to their machine is governed by their sync mode (\`hq sync mode\`), not by access.`,
+            ),
+          );
+        }
       } catch (err) {
         if (err instanceof InviteHttpError) {
           console.error(chalk.red(err.message));

package/src/index.ts

@@ -48,6 +48,8 @@ import { registerSignalsCommand } from "./commands/signals.js";
 import { registerReindexCommand } from "./commands/reindex.js";
 import { registerRescueCommand } from "./commands/rescue.js";
 import { registerMcpCommand } from "./commands/mcp-status.js";
+import { registerCrmCommand } from "./commands/crm.js";
+import { registerCompanyCommand } from "./commands/company.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { isEpipe } from "./utils/epipe.js";
@@ -214,6 +216,15 @@ registerRescueCommand(program);
 // off the configs, NOT linkStatus), with secret-redacted output + `--json`.
 registerMcpCommand(program);
 
+// Native CRM entity upsert (subcommand group — `hq crm entity upsert`). Wraps
+// POST /crm/entities (the ontology write gate) so an authenticated company
+// member can create/update canonical CRM entities in the company vault.
+registerCrmCommand(program);
+
+// Company settings (subcommand group — `hq company settings set`). Owner-only
+// toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
+registerCompanyCommand(program);
+
 (async () => {
   try {
     Sentry.addBreadcrumb({