@indigoai-us/hq-cli 5.57.0 → 5.58.1

package/dist/commands/people.d.ts

@@ -6,21 +6,25 @@
  *   hq people search <keyword> [--company <slug>] [--json]
  *   hq people resolve <name>   [--company <slug>] [--json]
  *
- * Source of truth is `companies/<company>/people/<person>/meta.yaml`. Every
- * subcommand operates on exactly ONE company (the active company, or the one
- * named by `--company`); nothing reads across company boundaries.
+ * Local records from `companies/<company>/people/<person>/meta.yaml` are the
+ * curated primary source. On misses, commands may fall back to the membership
+ * roster for exactly ONE company (the active company, or the one named by
+ * `--company`); nothing reads across company boundaries.
  */
 import { Command } from "commander";
+import { type ActiveMember } from "./members.js";
 import { resolveNameToEmail, type PersonRecord } from "../utils/people.js";
-export type RefreshPeopleRoster = (hqRoot: string, companySlug: string) => Promise<void>;
+export type FetchPeopleRoster = (hqRoot: string, companySlug: string) => Promise<PersonRecord[]>;
 interface PeopleCommandDeps {
-    refreshRoster?: RefreshPeopleRoster;
+    fetchRoster?: FetchPeopleRoster;
 }
 interface PeopleLookupOpts {
     localOnly?: boolean;
     json?: boolean;
 }
-export declare function refreshPeopleRosterFromCloud(hqRoot: string, companySlug: string): Promise<void>;
+export declare function activeMemberToPersonRecord(m: ActiveMember): PersonRecord | null;
+export declare function fetchMembershipRoster(hqRoot: string, companySlug: string): Promise<PersonRecord[]>;
+export declare function mergePeople(primary: PersonRecord[], extra: PersonRecord[]): PersonRecord[];
 /**
  * Resolve the single company to operate on. Explicit `--company` always wins
  * (after a path-safety check). Otherwise the active company is inferred from
@@ -33,14 +37,14 @@ export declare function resolvePersonWithRosterFallback(input: {
     slug: string;
     name: string;
     opts?: PeopleLookupOpts;
-    refreshRoster?: RefreshPeopleRoster;
+    fetchRoster?: FetchPeopleRoster;
 }): Promise<ReturnType<typeof resolveNameToEmail>>;
 export declare function searchPeopleWithRosterFallback(input: {
     hqRoot: string;
     slug: string;
     keyword: string;
     opts?: PeopleLookupOpts;
-    refreshRoster?: RefreshPeopleRoster;
+    fetchRoster?: FetchPeopleRoster;
 }): Promise<PersonRecord[]>;
 export declare function registerPeopleCommand(program: Command, deps?: PeopleCommandDeps): void;
 export {};

package/dist/commands/people.js

@@ -6,35 +6,73 @@
  *   hq people search <keyword> [--company <slug>] [--json]
  *   hq people resolve <name>   [--company <slug>] [--json]
  *
- * Source of truth is `companies/<company>/people/<person>/meta.yaml`. Every
- * subcommand operates on exactly ONE company (the active company, or the one
- * named by `--company`); nothing reads across company boundaries.
+ * Local records from `companies/<company>/people/<person>/meta.yaml` are the
+ * curated primary source. On misses, commands may fall back to the membership
+ * roster for exactly ONE company (the active company, or the one named by
+ * `--company`); nothing reads across company boundaries.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="79abc1f5-4f5a-5c95-b29b-10f04417355f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="555055d9-98e2-5fcd-b736-4b1df12daf4d")}catch(e){}}();
 import * as fs from "fs";
 import { Option } from "commander";
 import chalk from "chalk";
-import { VaultClient } from "@indigoai-us/hq-cloud";
 import * as yaml from "js-yaml";
 import { findHqRoot } from "../utils/manifest.js";
 import { manifestPath } from "./cloud-provision.js";
-import { DEFAULT_COGNITO, buildVaultConfig, ensureCognitoToken, } from "../utils/cognito-session.js";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
-import { createCompanyPresignClient, runGet } from "./files-browse.js";
+import { listActiveMembers } from "./members.js";
 import { assertSafeCompanySlug, listCompanyPeople, searchPeople, resolveNameToEmail, companyPeopleDir, } from "../utils/people.js";
-export async function refreshPeopleRosterFromCloud(hqRoot, companySlug) {
-    const accessToken = await ensureCognitoToken();
-    const client = new VaultClient(buildVaultConfig(accessToken));
-    await getCompanyUid(accessToken, companySlug);
-    await runGet({
-        path: `companies/${companySlug}/people/`,
-        hqRoot,
-        companySlug,
-        vaultClient: client,
-        companyClient: ({ companyUid }) => createCompanyPresignClient({ token: accessToken, companyUid }),
-        region: DEFAULT_COGNITO.region,
-    });
+function slugify(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/-+/g, "-")
+        .replace(/^-|-$/g, "");
+}
+export function activeMemberToPersonRecord(m) {
+    const name = m.personName?.trim() ||
+        m.personEmail?.trim() ||
+        m.personSlug?.trim() ||
+        "";
+    if (!name)
+        return null;
+    const email = m.personEmail?.trim() || undefined;
+    const slug = m.personSlug?.trim() || slugify(name) || m.personUid;
+    return {
+        slug,
+        name,
+        email,
+        role: m.role || undefined,
+        type: "internal",
+        source: `hq-pro membership: /membership/company/${m.companyUid}`,
+    };
+}
+export async function fetchMembershipRoster(hqRoot, companySlug) {
+    void hqRoot;
+    const token = await ensureCognitoToken();
+    const companyUid = await getCompanyUid(token, companySlug);
+    const members = await listActiveMembers(token, companyUid);
+    return members
+        .map(activeMemberToPersonRecord)
+        .filter((r) => r !== null);
+}
+function personIdentityKey(person) {
+    return (person.email?.toLowerCase() ||
+        person.slug?.toLowerCase() ||
+        person.name.toLowerCase());
+}
+export function mergePeople(primary, extra) {
+    const seen = new Set(primary.map(personIdentityKey));
+    const merged = [...primary];
+    for (const person of extra) {
+        const key = personIdentityKey(person);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        merged.push(person);
+    }
+    return merged;
 }
 /** Companies that still exist (anything not explicitly `status: archived`). */
 function activeCompanySlugs(manifest) {
@@ -103,37 +141,38 @@ function fail(message) {
     console.error(chalk.red(message));
     process.exit(1);
 }
-function logRefreshFailure(companySlug, err) {
+function logRosterFetchFailure(companySlug, err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(chalk.dim(`  Could not refresh people roster for '${companySlug}': ${message}`));
+    console.error(chalk.dim(`  Could not fetch people roster for '${companySlug}': ${message}`));
 }
-async function tryRefreshRoster(refreshRoster, hqRoot, slug) {
+async function tryFetchRoster(fetchRoster, hqRoot, slug) {
     try {
-        await refreshRoster(hqRoot, slug);
-        return true;
+        return await fetchRoster(hqRoot, slug);
     }
     catch (err) {
-        logRefreshFailure(slug, err);
-        return false;
+        logRosterFetchFailure(slug, err);
+        return null;
     }
 }
 export async function resolvePersonWithRosterFallback(input) {
-    const local = resolveNameToEmail(listCompanyPeople(input.hqRoot, input.slug), input.name);
+    const localPeople = listCompanyPeople(input.hqRoot, input.slug);
+    const local = resolveNameToEmail(localPeople, input.name);
     if (local.status !== "not_found" || input.opts?.localOnly)
         return local;
-    const refreshed = await tryRefreshRoster(input.refreshRoster ?? refreshPeopleRosterFromCloud, input.hqRoot, input.slug);
-    if (!refreshed)
+    const roster = await tryFetchRoster(input.fetchRoster ?? fetchMembershipRoster, input.hqRoot, input.slug);
+    if (!roster)
         return local;
-    return resolveNameToEmail(listCompanyPeople(input.hqRoot, input.slug), input.name);
+    return resolveNameToEmail(mergePeople(localPeople, roster), input.name);
 }
 export async function searchPeopleWithRosterFallback(input) {
-    const local = searchPeople(listCompanyPeople(input.hqRoot, input.slug), input.keyword);
+    const localPeople = listCompanyPeople(input.hqRoot, input.slug);
+    const local = searchPeople(localPeople, input.keyword);
     if (local.length > 0 || input.opts?.localOnly)
         return local;
-    const refreshed = await tryRefreshRoster(input.refreshRoster ?? refreshPeopleRosterFromCloud, input.hqRoot, input.slug);
-    if (!refreshed)
+    const roster = await tryFetchRoster(input.fetchRoster ?? fetchMembershipRoster, input.hqRoot, input.slug);
+    if (!roster)
         return local;
-    return searchPeople(listCompanyPeople(input.hqRoot, input.slug), input.keyword);
+    return searchPeople(mergePeople(localPeople, roster), input.keyword);
 }
 export function registerPeopleCommand(program, deps = {}) {
     const people = program
@@ -147,12 +186,19 @@ export function registerPeopleCommand(program, deps = {}) {
         .command("list")
         .description("List all people recorded for the company")
         .option("--json", "Output JSON instead of a table")
-        .action((opts) => {
+        .option("--local-only", "Skip network fallback; list only the local people roster")
+        .action(async (opts) => {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
             const slug = resolveCompanySlug(hqRoot, scope.company);
-            const records = listCompanyPeople(hqRoot, slug);
+            let records = listCompanyPeople(hqRoot, slug);
+            if (!opts.localOnly) {
+                const roster = await tryFetchRoster(deps.fetchRoster ?? fetchMembershipRoster, hqRoot, slug);
+                if (roster)
+                    records = mergePeople(records, roster);
+            }
+            records = records.sort((a, b) => a.name.localeCompare(b.name));
             if (opts.json) {
                 console.log(JSON.stringify(records, null, 2));
                 return;
@@ -171,7 +217,7 @@ export function registerPeopleCommand(program, deps = {}) {
         .command("search <keyword>")
         .description("Keyword search over people names and emails")
         .option("--json", "Output JSON instead of a table")
-        .option("--local-only", "Skip cloud fallback; search only the local people roster")
+        .option("--local-only", "Skip network fallback; search only the local people roster")
         .action(async (keyword, opts) => {
         try {
             const scope = people.opts();
@@ -182,7 +228,7 @@ export function registerPeopleCommand(program, deps = {}) {
                 slug,
                 keyword,
                 opts,
-                refreshRoster: deps.refreshRoster,
+                fetchRoster: deps.fetchRoster,
             });
             if (opts.json) {
                 console.log(JSON.stringify(matches, null, 2));
@@ -202,7 +248,7 @@ export function registerPeopleCommand(program, deps = {}) {
         .command("resolve <name>")
         .description("Resolve a person name to their email address")
         .option("--json", "Output JSON instead of plain text")
-        .option("--local-only", "Skip cloud fallback; resolve only from the local people roster")
+        .option("--local-only", "Skip network fallback; resolve only from the local people roster")
         .action(async (name, opts) => {
         try {
             const scope = people.opts();
@@ -213,7 +259,7 @@ export function registerPeopleCommand(program, deps = {}) {
                 slug,
                 name,
                 opts,
-                refreshRoster: deps.refreshRoster,
+                fetchRoster: deps.fetchRoster,
             });
             if (opts.json) {
                 console.log(JSON.stringify(result, null, 2));
@@ -247,4 +293,4 @@ export function registerPeopleCommand(program, deps = {}) {
     });
 }
 //# sourceMappingURL=people.js.map
-//# debugId=79abc1f5-4f5a-5c95-b29b-10f04417355f
+//# debugId=555055d9-98e2-5fcd-b736-4b1df12daf4d

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="18312d3d-7daf-5faf-ac29-c82ce7bd0b29")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="12b04dfd-a264-56c7-bfbb-a448c35689b3")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -217,14 +217,8 @@ export function scrubSandboxOutput(text, secretNames = []) {
         .replace(/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, "[REDACTED]");
 }
 function renderSandboxJobResult(job, secretNames) {
-    if (job.stdout) {
-        process.stdout.write(scrubSandboxOutput(job.stdout, secretNames));
-    }
-    if (job.stderr) {
-        process.stderr.write(scrubSandboxOutput(job.stderr, secretNames));
-    }
-    if (job.logsTail) {
-        process.stderr.write(scrubSandboxOutput(job.logsTail, secretNames));
+    if (job.output) {
+        process.stdout.write(scrubSandboxOutput(job.output, secretNames));
     }
 }
 function normalizePolicyRecord(secretPath, data) {
@@ -872,47 +866,46 @@ export function registerSecretsCommand(program) {
     });
     secrets
         .command("sandbox")
-        .description("Run a skill in the hosted sandbox with secrets injected server-side")
+        .description("Run a command in the hosted sandbox with named secrets injected as env vars; open egress, secrets never touch this machine")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--personal", "Operate on the caller's personal vault (no sharing)")
-        .option("--only <keys>", "Comma-separated list of secret names the skill may use")
-        .option("--script <path>", "Attach local script identity for script-locked secrets")
+        .option("--only <keys>", "Comma-separated list of secret names to inject (required)")
         .allowUnknownOption(true)
         .action(async (opts, cmd) => {
         try {
-            const dashIndex = process.argv.indexOf("--");
-            const rawArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : cmd.args;
-            if (rawArgs.length === 0) {
-                console.error(chalk.red("Error: no skill specified. Usage: hq secrets sandbox [--company X] [--only KEY1,KEY2] -- <skill> [args...]"));
+            if (!opts.only || opts.only.trim().length === 0) {
+                console.error(chalk.red("Error: --only is required and must name at least one secret."));
+                process.exit(1);
+            }
+            const rawArgs = cmd.args;
+            const command = rawArgs.join(" ").trim();
+            if (command.length === 0) {
+                console.error(chalk.red("Error: no command specified. Usage: hq secrets sandbox --company <slug> --only KEY1,KEY2 -- <command>"));
                 process.exit(1);
             }
-            const [skillId, ...skillArgs] = rawArgs;
-            const keys = opts.only ? parseSecretNameList(opts.only) : [];
+            if (command.length > 8192) {
+                console.error(chalk.red("Error: sandbox command exceeds the 8192 character limit."));
+                process.exit(1);
+            }
+            const keys = parseSecretNameList(opts.only);
             const token = await ensureCognitoToken();
             const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
             const companyUid = await getEntityUid(token, scope);
-            const usage = await buildSecretUsage("sandbox", opts.script);
             const client = new SandboxRunnerClient();
             const started = await client.startJob(token, {
-                skillId,
                 companyUid,
-                args: skillArgs.length > 0 ? { argv: skillArgs } : undefined,
-                companySlug: scope.companySlug,
-                only: keys.length > 0 ? keys : undefined,
-                usage,
+                secretNames: keys,
+                command,
             });
             const job = started.status === "succeeded" || started.status === "failed"
                 ? await client.getJob(token, started.jobId)
                 : await client.pollJob(token, started.jobId);
             renderSandboxJobResult(job, keys);
-            if (job.status === "failed") {
-                if (job.error) {
-                    console.error(chalk.red("Sandbox job failed:"), scrubSandboxOutput(job.error, keys));
-                }
-                process.exit(job.exitCode && job.exitCode > 0 ? job.exitCode : 1);
-            }
-            if (job.exitCode && job.exitCode !== 0) {
-                process.exit(job.exitCode);
+            const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
+            if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {
+                const code = exitCode && exitCode !== 0 ? exitCode : 1;
+                console.error(chalk.red(`Sandbox command failed with exit code ${code}.`));
+                process.exit(code);
             }
         }
         catch (err) {
@@ -1261,4 +1254,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=18312d3d-7daf-5faf-ac29-c82ce7bd0b29
+//# debugId=12b04dfd-a264-56c7-bfbb-a448c35689b3

package/dist/utils/sandbox-runner-client.d.ts

@@ -1,11 +1,8 @@
 export type SandboxRunnerState = "queued" | "running" | "succeeded" | "failed";
 export interface SandboxRunnerStartRequest {
-    skillId: string;
     companyUid: string;
-    args?: Record<string, unknown>;
-    companySlug?: string;
-    only?: string[];
-    usage?: unknown;
+    secretNames: string[];
+    command: string;
 }
 export interface SandboxRunnerStartResponse {
     jobId: string;
@@ -14,11 +11,9 @@ export interface SandboxRunnerStartResponse {
 export interface SandboxRunnerJob {
     jobId: string;
     status: SandboxRunnerState;
-    stdout?: string;
-    stderr?: string;
-    logsTail?: string;
+    output?: string;
     exitCode?: number;
-    error?: string;
+    success?: boolean;
 }
 export interface SandboxRunnerClientOptions {
     baseUrl?: string;

package/dist/utils/sandbox-runner-client.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8203259b-d3ae-5c9b-845e-f4c1470c30f3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3cbec729-3b2b-5d53-9e90-5680dd725b7d")}catch(e){}}();
 const DEFAULT_SANDBOX_RUNNER_URL = "https://hqapi.getindigo.ai/sandbox";
 function normalizeBaseUrl(baseUrl) {
     return baseUrl.replace(/\/+$/, "");
@@ -25,21 +25,14 @@ function normalizeJob(body, jobIdFallback) {
     if (!isSandboxRunnerState(status)) {
         throw new Error("Sandbox Runner returned an invalid job status.");
     }
-    const output = typeof body.stdout === "string"
-        ? body.stdout
-        : typeof body.output === "string"
-            ? body.output
-            : undefined;
     return {
         jobId: typeof body.jobId === "string" && body.jobId.length > 0
             ? body.jobId
             : jobIdFallback ?? requireString(body, "jobId"),
         status,
-        stdout: output,
-        stderr: typeof body.stderr === "string" ? body.stderr : undefined,
-        logsTail: typeof body.logsTail === "string" ? body.logsTail : undefined,
+        output: typeof body.output === "string" ? body.output : undefined,
         exitCode: typeof body.exitCode === "number" ? body.exitCode : undefined,
-        error: typeof body.error === "string" ? body.error : undefined,
+        success: typeof body.success === "boolean" ? body.success : undefined,
     };
 }
 function delay(ms) {
@@ -110,4 +103,4 @@ export class SandboxRunnerClient {
     }
 }
 //# sourceMappingURL=sandbox-runner-client.js.map
-//# debugId=8203259b-d3ae-5c9b-845e-f4c1470c30f3
+//# debugId=3cbec729-3b2b-5d53-9e90-5680dd725b7d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.57.0",
+  "version": "5.58.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {