@indigoai-us/hq-cli 5.53.0 → 5.53.1

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.53.1]
+
+### Changed
+
+- **`hq members promote` now clarifies admin access.** Promoting someone to
+  `owner` or `admin` prints that they automatically have full read and write
+  access to all of the company's context — there is no separate context grant to
+  give them (owners/admins resolve to full access via the server-side role
+  bypass) — and that what they actually see synced locally is governed by their
+  sync mode (`hq sync mode`), not by access. Member/guest promotions are
+  unchanged.
+
 ## [5.53.0]
 
 ### Added

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="83a54ed2-3f52-5b6f-a784-09f78f488ddd")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c844265d-9140-55ac-8fc7-c0b2a049a0af")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -316,6 +316,15 @@ export function registerMembersCommand(program) {
             const membershipKey = resolveRevokeTargetToMembershipKey(target, companyUid);
             await changeMemberRole(token, companyUid, membershipKey, role);
             console.log(chalk.green(`Updated role for '${target}' to ${role}`));
+            if (role === "owner" || role === "admin") {
+                // Clarify the common confusion: owners/admins already get full
+                // access to ALL company context automatically via the role bypass
+                // (hq-pro resolveEffectivePermission) — there is no separate context
+                // grant to give them. What they SEE locally is governed by their sync
+                // mode, not by access.
+                console.log(chalk.dim(`${role === "owner" ? "Owners" : "Admins"} automatically have full read and write access to all of this company's context — no separate context grant is needed.\n` +
+                    `What they actually see synced to their machine is governed by their sync mode (\`hq sync mode\`), not by access.`));
+            }
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
@@ -555,4 +564,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=83a54ed2-3f52-5b6f-a784-09f78f488ddd
+//# debugId=c844265d-9140-55ac-8fc7-c0b2a049a0af

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.53.0",
+  "version": "5.53.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/members.test.ts

@@ -1051,11 +1051,21 @@ describe("registerMembersCommand promote", () => {
     expect(logSpy).toHaveBeenCalledWith(
       expect.stringContaining("Updated role for 'alice@example.com' to admin"),
     );
+    // Clarifies that admins already have full context access automatically
+    // (no separate grant) and that sync mode governs local visibility.
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining(
+        "Admins automatically have full read and write access",
+      ),
+    );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("governed by their sync mode"),
+    );
   });
 
   it("forwards a personUid target and the guest role (beyond set-role's admin|member cap)", async () => {
     fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    vi.spyOn(console, "log").mockImplementation(() => undefined);
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
 
     await buildMembersProgram().parseAsync(
       ["members", "--company", "acme", "promote", "prs_bob", "guest"],
@@ -1070,6 +1080,11 @@ describe("registerMembersCommand promote", () => {
       membershipKey: "prs_bob#cmp_acme",
       newRole: "guest",
     });
+    // The full-access clarification applies ONLY to the role-bypass roles
+    // (owner/admin) — a guest/member promotion must not claim full access.
+    expect(logSpy).not.toHaveBeenCalledWith(
+      expect.stringContaining("full read and write access"),
+    );
   });
 
   it("rejects an invalid role at the CLI and exits non-zero without a network call", async () => {

package/src/commands/members.ts

@@ -575,6 +575,19 @@ export function registerMembersCommand(program: Command): void {
         console.log(
           chalk.green(`Updated role for '${target}' to ${role}`),
         );
+        if (role === "owner" || role === "admin") {
+          // Clarify the common confusion: owners/admins already get full
+          // access to ALL company context automatically via the role bypass
+          // (hq-pro resolveEffectivePermission) — there is no separate context
+          // grant to give them. What they SEE locally is governed by their sync
+          // mode, not by access.
+          console.log(
+            chalk.dim(
+              `${role === "owner" ? "Owners" : "Admins"} automatically have full read and write access to all of this company's context — no separate context grant is needed.\n` +
+                `What they actually see synced to their machine is governed by their sync mode (\`hq sync mode\`), not by access.`,
+            ),
+          );
+        }
       } catch (err) {
         if (err instanceof InviteHttpError) {
           console.error(chalk.red(err.message));