@indigoai-us/hq-cli 5.61.0 → 5.62.0

package/dist/lib/db/paths.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Vault database path conventions (C1 local tier).
+ *
+ * Canonical layout (locked by vault-databases PRD):
+ *   ~/.hq/db/{companySlug}/vault.db
+ *
+ * Binary DB files are machine-local. They must never live under companies/
+ * so hq-sync / git cannot treat them as vault text. Migrations remain vault
+ * text at companies/{co}/db/migrations/*.sql (handled by migrate stories).
+ */
+/** Default filename for the per-company local vault SQLite file. */
+export declare const LOCAL_VAULT_DB_FILENAME = "vault.db";
+/**
+ * Glob-style ignore patterns for binary / local DB artifacts.
+ * Apply in gitignore and hq-sync ignore configuration for any tree that
+ * might accidentally host these files. Primary storage is under ~/.hq/db/
+ * (outside the vault), but skills must still ignore stray `*.db` / `.data/`.
+ */
+export declare const LOCAL_DB_IGNORE_PATTERNS: readonly string[];
+export interface LocalDbPathEnv {
+    /** Override home directory (tests inject temp dirs). Defaults to os.homedir(). */
+    home?: string;
+}
+/**
+ * Resolve the machine-local root that holds all company vault DBs:
+ * `{home}/.hq/db`.
+ */
+export declare function resolveLocalDbRoot(env?: LocalDbPathEnv): string;
+/**
+ * Normalize and validate a company slug used in the local path.
+ * Tenant isolation still requires HQ identity/membership at the command layer;
+ * this only rejects empty / path-traversal slugs so we never open arbitrary paths.
+ */
+export declare function normalizeCompanySlugForLocalDb(companySlug: string): string;
+/**
+ * Canonical path for a company's local vault SQLite file:
+ * `~/.hq/db/{companySlug}/vault.db`.
+ */
+export declare function resolveLocalDbPath(companySlug: string, env?: LocalDbPathEnv): string;
+/**
+ * Directory that contains the company's vault.db (and WAL side files).
+ */
+export declare function resolveLocalDbDir(companySlug: string, env?: LocalDbPathEnv): string;
+/**
+ * Ensure the company local DB directory exists and is writable.
+ * Creates parent directories recursively. Does not create the .db file
+ * and does not write secrets into the tree.
+ *
+ * @returns absolute path of the directory
+ */
+export declare function ensureLocalDbDir(companySlug: string, env?: LocalDbPathEnv): string;
+/**
+ * Human-readable documentation of ignore rules for operators and agents.
+ */
+export declare function describeLocalDbIgnoreRules(): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/lib/db/paths.js

@@ -0,0 +1,103 @@
+/**
+ * Vault database path conventions (C1 local tier).
+ *
+ * Canonical layout (locked by vault-databases PRD):
+ *   ~/.hq/db/{companySlug}/vault.db
+ *
+ * Binary DB files are machine-local. They must never live under companies/
+ * so hq-sync / git cannot treat them as vault text. Migrations remain vault
+ * text at companies/{co}/db/migrations/*.sql (handled by migrate stories).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="92e78769-940e-5fc9-a47e-7fbcc4415a3b")}catch(e){}}();
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/** Default filename for the per-company local vault SQLite file. */
+export const LOCAL_VAULT_DB_FILENAME = "vault.db";
+/**
+ * Glob-style ignore patterns for binary / local DB artifacts.
+ * Apply in gitignore and hq-sync ignore configuration for any tree that
+ * might accidentally host these files. Primary storage is under ~/.hq/db/
+ * (outside the vault), but skills must still ignore stray `*.db` / `.data/`.
+ */
+export const LOCAL_DB_IGNORE_PATTERNS = [
+    "**/*.db",
+    "**/*.db-wal",
+    "**/*.db-shm",
+    "**/*.db-journal",
+    "**/.data/**",
+    // Explicit machine-local root (if a tool ever materializes a relative copy)
+    "**/.hq/db/**",
+];
+/**
+ * Resolve the machine-local root that holds all company vault DBs:
+ * `{home}/.hq/db`.
+ */
+export function resolveLocalDbRoot(env) {
+    const home = (env?.home ?? os.homedir()).trim();
+    if (!home) {
+        throw new Error("cannot resolve local DB root: home directory is empty (set home or os.homedir())");
+    }
+    return path.join(home, ".hq", "db");
+}
+/**
+ * Normalize and validate a company slug used in the local path.
+ * Tenant isolation still requires HQ identity/membership at the command layer;
+ * this only rejects empty / path-traversal slugs so we never open arbitrary paths.
+ */
+export function normalizeCompanySlugForLocalDb(companySlug) {
+    const slug = companySlug.trim().toLowerCase();
+    if (!slug) {
+        throw new Error("company slug is required for local DB path resolution");
+    }
+    if (slug.includes("/") ||
+        slug.includes("\\") ||
+        slug.includes("..") ||
+        slug === "." ||
+        slug.includes("\0")) {
+        throw new Error(`invalid company slug for local DB path: ${JSON.stringify(companySlug)}`);
+    }
+    return slug;
+}
+/**
+ * Canonical path for a company's local vault SQLite file:
+ * `~/.hq/db/{companySlug}/vault.db`.
+ */
+export function resolveLocalDbPath(companySlug, env) {
+    const slug = normalizeCompanySlugForLocalDb(companySlug);
+    return path.join(resolveLocalDbRoot(env), slug, LOCAL_VAULT_DB_FILENAME);
+}
+/**
+ * Directory that contains the company's vault.db (and WAL side files).
+ */
+export function resolveLocalDbDir(companySlug, env) {
+    return path.dirname(resolveLocalDbPath(companySlug, env));
+}
+/**
+ * Ensure the company local DB directory exists and is writable.
+ * Creates parent directories recursively. Does not create the .db file
+ * and does not write secrets into the tree.
+ *
+ * @returns absolute path of the directory
+ */
+export function ensureLocalDbDir(companySlug, env) {
+    const dir = resolveLocalDbDir(companySlug, env);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Verify writable without leaving secrets or DB content behind.
+    fs.accessSync(dir, fs.constants.W_OK);
+    return dir;
+}
+/**
+ * Human-readable documentation of ignore rules for operators and agents.
+ */
+export function describeLocalDbIgnoreRules() {
+    return [
+        "Local vault databases live at ~/.hq/db/{company}/vault.db (outside the vault tree).",
+        "Never place *.db under companies/ — binary DB state is not vault-synced.",
+        "Ignore patterns:",
+        ...LOCAL_DB_IGNORE_PATTERNS.map((p) => `  - ${p}`),
+    ].join("\n");
+}
+//# sourceMappingURL=paths.js.map
+//# debugId=92e78769-940e-5fc9-a47e-7fbcc4415a3b

package/dist/lib/db/remote-engine.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Pluggable remote vault DB engine interface (vault-databases US-007).
+ *
+ * Default shipped adapter id: aurora-dsql.
+ * This module is interface + registry only — no production AWS provision here.
+ */
+/** Connection material written only to secrets stores — never CLI stdout. */
+export interface RemoteConnectionSecretPayload {
+    /** Opaque secret body (e.g. JSON with host/user/password or IAM token recipe). */
+    payload: Record<string, unknown>;
+    /** Suggested vault/Secrets Manager key suffix (namespaced by company elsewhere). */
+    secretNameHint: string;
+}
+export interface RemoteProvisionRequest {
+    companyUid: string;
+    companySlug: string;
+    region?: string;
+    /** Engine-specific options (cluster params, etc.). */
+    options?: Record<string, unknown>;
+}
+export interface RemoteProvisionResult {
+    engineId: string;
+    resourceArn: string;
+    region: string;
+    status: "ready" | "provisioning" | "failed" | "existing";
+    /** Secret payload to store — callers must not print. */
+    connectionSecret: RemoteConnectionSecretPayload;
+}
+export interface RemoteHealth {
+    engineId: string;
+    resourceArn: string;
+    healthy: boolean;
+    status: string;
+    checkedAt: string;
+}
+/**
+ * Remote Postgres-class engine adapter.
+ * Implementations live in control plane (hq-pro) for real AWS; CLI may mock.
+ */
+export interface RemoteDbEngine {
+    readonly id: string;
+    provision(req: RemoteProvisionRequest): Promise<RemoteProvisionResult>;
+    deprovision(companyUid: string, resourceArn: string): Promise<void>;
+    connectionSecretPayload(companyUid: string, resourceArn: string): Promise<RemoteConnectionSecretPayload>;
+    healthCheck(resourceArn: string): Promise<RemoteHealth>;
+}
+/** Default engine selection (PRD decision). */
+export declare const DEFAULT_REMOTE_ENGINE_ID = "aurora-dsql";
+export declare function registerRemoteEngine(engine: RemoteDbEngine): void;
+export declare function getRemoteEngine(id?: string): RemoteDbEngine;
+export declare function listRemoteEngineIds(): string[];
+/** Clear registry (tests only). */
+export declare function _resetRemoteEngineRegistryForTests(): void;
+/**
+ * In-memory mock engine for unit tests — no AWS.
+ */
+export declare function createMockRemoteEngine(id?: string): RemoteDbEngine;
+//# sourceMappingURL=remote-engine.d.ts.map

package/dist/lib/db/remote-engine.js

@@ -0,0 +1,90 @@
+/**
+ * Pluggable remote vault DB engine interface (vault-databases US-007).
+ *
+ * Default shipped adapter id: aurora-dsql.
+ * This module is interface + registry only — no production AWS provision here.
+ */
+/** Default engine selection (PRD decision). */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="738ccb65-e1d0-5466-b98e-a96058bda113")}catch(e){}}();
+export const DEFAULT_REMOTE_ENGINE_ID = "aurora-dsql";
+const registry = new Map();
+export function registerRemoteEngine(engine) {
+    registry.set(engine.id, engine);
+}
+export function getRemoteEngine(id = DEFAULT_REMOTE_ENGINE_ID) {
+    const engine = registry.get(id);
+    if (!engine) {
+        throw new Error(`remote DB engine not registered: ${id} (available: ${[...registry.keys()].join(", ") || "none"})`);
+    }
+    return engine;
+}
+export function listRemoteEngineIds() {
+    return [...registry.keys()];
+}
+/** Clear registry (tests only). */
+export function _resetRemoteEngineRegistryForTests() {
+    registry.clear();
+}
+/**
+ * In-memory mock engine for unit tests — no AWS.
+ */
+export function createMockRemoteEngine(id = "mock") {
+    const resources = new Map();
+    return {
+        id,
+        async provision(req) {
+            const existing = [...resources.entries()].find(([, v]) => v.companyUid === req.companyUid);
+            if (existing) {
+                const [arn, meta] = existing;
+                return {
+                    engineId: id,
+                    resourceArn: arn,
+                    region: meta.region,
+                    status: "existing",
+                    connectionSecret: {
+                        payload: { mock: true, companyUid: req.companyUid },
+                        secretNameHint: `db/remote/${req.companySlug}`,
+                    },
+                };
+            }
+            const arn = `arn:mock:db:${req.companyUid}`;
+            const region = req.region ?? "us-east-1";
+            resources.set(arn, { companyUid: req.companyUid, region });
+            return {
+                engineId: id,
+                resourceArn: arn,
+                region,
+                status: "ready",
+                connectionSecret: {
+                    payload: { mock: true, companyUid: req.companyUid },
+                    secretNameHint: `db/remote/${req.companySlug}`,
+                },
+            };
+        },
+        async deprovision(companyUid, resourceArn) {
+            const meta = resources.get(resourceArn);
+            if (meta && meta.companyUid === companyUid) {
+                resources.delete(resourceArn);
+            }
+        },
+        async connectionSecretPayload(companyUid, resourceArn) {
+            return {
+                payload: { mock: true, companyUid, resourceArn },
+                secretNameHint: `db/remote/${companyUid}`,
+            };
+        },
+        async healthCheck(resourceArn) {
+            const ok = resources.has(resourceArn);
+            return {
+                engineId: id,
+                resourceArn,
+                healthy: ok,
+                status: ok ? "ready" : "missing",
+                checkedAt: new Date().toISOString(),
+            };
+        },
+    };
+}
+//# sourceMappingURL=remote-engine.js.map
+//# debugId=738ccb65-e1d0-5466-b98e-a96058bda113

package/dist/lib/db/remote-sql.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Remote SQL via secrets-exec style injection (US-010).
+ *
+ * Connection string never appears in argv, logs, or stdout.
+ * Local remains default when --remote is absent (handled by command layer).
+ */
+export interface RemoteSqlOptions {
+    company: string;
+    sql: string;
+    /** Injected secret material — never log. */
+    getConnectionConfig: () => Promise<Record<string, unknown>>;
+    /** Execute against remote; tests inject mock. */
+    execute?: (config: Record<string, unknown>, sql: string) => Promise<Record<string, unknown>[]>;
+}
+export interface RemoteSqlResult {
+    rows: Record<string, unknown>[];
+}
+/**
+ * Run SQL on remote tier using vault-bound credentials.
+ */
+export declare function runRemoteSql(opts: RemoteSqlOptions): Promise<RemoteSqlResult>;
+//# sourceMappingURL=remote-sql.d.ts.map

package/dist/lib/db/remote-sql.js

@@ -0,0 +1,39 @@
+/**
+ * Remote SQL via secrets-exec style injection (US-010).
+ *
+ * Connection string never appears in argv, logs, or stdout.
+ * Local remains default when --remote is absent (handled by command layer).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="07948af3-ec73-5a1a-bf8a-d0197090af40")}catch(e){}}();
+function assertNoLeak(label, value) {
+    const s = typeof value === "string" ? value : JSON.stringify(value);
+    if (/postgres:\/\//i.test(s) || /postgresql:\/\//i.test(s)) {
+        throw new Error(`${label}: connection string leak blocked`);
+    }
+}
+/**
+ * Run SQL on remote tier using vault-bound credentials.
+ */
+export async function runRemoteSql(opts) {
+    if (!opts.sql?.trim()) {
+        throw new Error("SQL statement is required");
+    }
+    let config;
+    try {
+        config = await opts.getConnectionConfig();
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : "no remote binding";
+        throw new Error(`remote SQL unavailable: ${msg}. Run \`hq db provision --company ${opts.company}\` first.`);
+    }
+    assertNoLeak("connection config", config);
+    if (!opts.execute) {
+        throw new Error("remote SQL executor not configured in this build (adapter pending live DSQL wire-up)");
+    }
+    const rows = await opts.execute(config, opts.sql);
+    assertNoLeak("remote sql rows", rows);
+    return { rows };
+}
+//# sourceMappingURL=remote-sql.js.map
+//# debugId=07948af3-ec73-5a1a-bf8a-d0197090af40

package/dist/lib/db/sql.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Local SQL execution helpers (vault-databases US-004).
+ *
+ * Company scope is path-bound via resolveLocalDbPath — callers must pass the
+ * resolved company slug from HQ session/flags. Path overrides that open
+ * another company's DB are denied unless an explicit dangerous flag is set.
+ */
+import { type LocalDbPathEnv } from "./paths.js";
+export interface SqlRunOptions extends LocalDbPathEnv {
+    company: string;
+    sql: string;
+    /** Allow INSERT/UPDATE/DELETE/DDL. Default false (read-only). */
+    write?: boolean;
+    /**
+     * Dangerous: open an absolute DB path instead of the company canonical path.
+     * Denied unless allowCrossCompanyPath is true.
+     */
+    dbPathOverride?: string;
+    /** Explicit dangerous flag to open a non-canonical local DB path. Default false. */
+    allowCrossCompanyPath?: boolean;
+    /** Output format */
+    format?: "jsonl" | "table";
+}
+export interface SqlRunResult {
+    columns: string[];
+    rows: Record<string, unknown>[];
+    changes: number;
+    readonly: boolean;
+}
+export declare function stripSqlNoise(sql: string): string;
+export declare function isWriteSql(sql: string): boolean;
+/**
+ * Statements that must never run via `hq db sql`, even with --write.
+ * ATTACH/DETACH would let a company-scoped session open another company's
+ * vault.db by absolute path (category-1 isolation).
+ */
+export declare function assertSqlAllowed(sql: string): void;
+/**
+ * Resolve which file path to open, enforcing company isolation by default.
+ */
+export declare function resolveSqlDbPath(opts: SqlRunOptions): string;
+/**
+ * Execute SQL against the company local vault DB.
+ */
+export declare function runLocalSql(opts: SqlRunOptions): SqlRunResult;
+export declare function formatSqlResult(result: SqlRunResult, format?: "jsonl" | "table"): string;
+/** Test helper: company dir for isolation assertions. */
+export declare function companyLocalDbDir(company: string, env?: LocalDbPathEnv): string;
+//# sourceMappingURL=sql.d.ts.map

package/dist/lib/db/sql.js

@@ -0,0 +1,132 @@
+/**
+ * Local SQL execution helpers (vault-databases US-004).
+ *
+ * Company scope is path-bound via resolveLocalDbPath — callers must pass the
+ * resolved company slug from HQ session/flags. Path overrides that open
+ * another company's DB are denied unless an explicit dangerous flag is set.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f9dc08da-ad30-5af4-94fb-b167d4299692")}catch(e){}}();
+import Database from "better-sqlite3";
+import { openLocalDb } from "./local.js";
+import { normalizeCompanySlugForLocalDb, resolveLocalDbDir, resolveLocalDbPath, } from "./paths.js";
+const WRITE_PATTERN = /^\s*(INSERT|UPDATE|DELETE|REPLACE|CREATE|DROP|ALTER|TRUNCATE|REINDEX|VACUUM|BEGIN|COMMIT|ROLLBACK)\b/i;
+/** Always forbidden — opens other files/DBs and breaks company path isolation. */
+const FORBIDDEN_SQL_PATTERN = /\b(ATTACH|DETACH|LOAD_EXTENSION)\b/i;
+export function stripSqlNoise(sql) {
+    return sql
+        .replace(/^\s*--[^\n]*\n/gm, "")
+        .replace(/^\s*\/\*[\s\S]*?\*\//gm, "")
+        .trim();
+}
+export function isWriteSql(sql) {
+    return WRITE_PATTERN.test(stripSqlNoise(sql));
+}
+/**
+ * Statements that must never run via `hq db sql`, even with --write.
+ * ATTACH/DETACH would let a company-scoped session open another company's
+ * vault.db by absolute path (category-1 isolation).
+ */
+export function assertSqlAllowed(sql) {
+    const stripped = stripSqlNoise(sql);
+    if (FORBIDDEN_SQL_PATTERN.test(stripped)) {
+        throw new Error("ATTACH/DETACH/LOAD_EXTENSION are not allowed via hq db sql (tenant isolation); use the company-canonical local path only");
+    }
+}
+/**
+ * Resolve which file path to open, enforcing company isolation by default.
+ */
+export function resolveSqlDbPath(opts) {
+    const company = normalizeCompanySlugForLocalDb(opts.company);
+    const canonical = resolveLocalDbPath(company, opts);
+    if (!opts.dbPathOverride) {
+        return canonical;
+    }
+    if (opts.dbPathOverride === canonical) {
+        return canonical;
+    }
+    if (!opts.allowCrossCompanyPath) {
+        throw new Error("cross-company or path override denied: refusing to open a non-canonical local DB path without --allow-cross-company-path (dangerous)");
+    }
+    return opts.dbPathOverride;
+}
+function openByPath(dbPath) {
+    const db = new Database(dbPath);
+    db.pragma("journal_mode = WAL");
+    db.pragma("foreign_keys = ON");
+    return db;
+}
+/**
+ * Execute SQL against the company local vault DB.
+ */
+export function runLocalSql(opts) {
+    const sql = opts.sql?.trim();
+    if (!sql) {
+        throw new Error("SQL statement is required");
+    }
+    assertSqlAllowed(sql);
+    const writeRequested = !!opts.write;
+    if (isWriteSql(sql) && !writeRequested) {
+        throw new Error("write/DDL statement blocked in read-only mode; pass --write to allow (prefer hq db migrate for schema changes)");
+    }
+    const dbPath = resolveSqlDbPath(opts);
+    const usingCanonical = !opts.dbPathOverride || opts.dbPathOverride === resolveLocalDbPath(opts.company, opts);
+    const db = usingCanonical
+        ? openLocalDb(opts.company, opts)
+        : openByPath(dbPath);
+    try {
+        if (!writeRequested) {
+            db.pragma("query_only = ON");
+        }
+        const stmt = db.prepare(sql);
+        if (stmt.reader) {
+            const rows = stmt.all();
+            const columns = rows.length > 0
+                ? Object.keys(rows[0])
+                : stmt.columns().map((c) => c.name);
+            return {
+                columns,
+                rows,
+                changes: 0,
+                readonly: !writeRequested,
+            };
+        }
+        const info = stmt.run();
+        return {
+            columns: ["changes", "lastInsertRowid"],
+            rows: [
+                {
+                    changes: info.changes,
+                    lastInsertRowid: Number(info.lastInsertRowid),
+                },
+            ],
+            changes: info.changes,
+            readonly: !writeRequested,
+        };
+    }
+    finally {
+        db.close();
+    }
+}
+export function formatSqlResult(result, format = "jsonl") {
+    if (format === "jsonl") {
+        if (result.rows.length === 0) {
+            return JSON.stringify({ columns: result.columns, rows: 0 });
+        }
+        return result.rows.map((r) => JSON.stringify(r)).join("\n");
+    }
+    const cols = result.columns;
+    if (cols.length === 0)
+        return "(no columns)";
+    const header = cols.join("\t");
+    const body = result.rows
+        .map((r) => cols.map((c) => String(r[c] ?? "")).join("\t"))
+        .join("\n");
+    return body ? `${header}\n${body}` : header;
+}
+/** Test helper: company dir for isolation assertions. */
+export function companyLocalDbDir(company, env) {
+    return resolveLocalDbDir(company, env);
+}
+//# sourceMappingURL=sql.js.map
+//# debugId=f9dc08da-ad30-5af4-94fb-b167d4299692

package/dist/main.js

@@ -5,7 +5,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a2c1badb-d418-557d-a0f4-0e3defd13913")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d089113e-52b9-5313-a256-63f054d8e72a")}catch(e){}}();
 import "./node-preflight.js";
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
@@ -35,9 +35,11 @@ import { registerApiKeysCommand } from "./commands/api-keys.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
 import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
+import { registerWorkersCommand } from "./commands/workers.js";
 import { registerGroupGrantsCommand } from "./commands/group-grants.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerFilesBrowseCommands } from "./commands/files-browse.js";
+import { registerSkillCommand } from "./commands/skill.js";
 import { registerMembersCommand } from "./commands/members.js";
 import { registerPeopleCommand } from "./commands/people.js";
 import { registerDmCommand } from "./commands/dm.js";
@@ -46,11 +48,15 @@ import { registerFeedbackCommand } from "./commands/feedback.js";
 import { registerMeetingsCommand } from "./commands/meetings.js";
 import { registerSourcesCommand } from "./commands/sources.js";
 import { registerSignalsCommand } from "./commands/signals.js";
+import { registerIntegrationsCommand } from "./commands/integrations.js";
 import { registerReindexCommand } from "./commands/reindex.js";
 import { registerRescueCommand } from "./commands/rescue.js";
 import { registerMcpCommand } from "./commands/mcp-status.js";
 import { registerCrmCommand } from "./commands/crm.js";
 import { registerCompanyCommand } from "./commands/company.js";
+import { registerAgentsCommand } from "./commands/agents.js";
+import { registerOutpostsCommand } from "./commands/outposts.js";
+import { registerDbCommand } from "./commands/db.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { isEpipe } from "./utils/epipe.js";
@@ -133,12 +139,16 @@ registerWhoamiCommand(program);
 registerAuthCommands(program);
 // Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
 registerSecretsCommand(program);
+// Vault databases (subcommand group — hq db status|sql|migrate|provision)
+registerDbCommand(program);
 // API key management (subcommand group — hq api-keys create|list|revoke)
 registerApiKeysCommand(program);
 // Schema-driven dev runner — hq run [options] -- <cmd>
 registerRunCommand(program);
 // Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
 registerGroupsCommand(program);
+// Worker discovery + sharing (subcommand group — hq workers list|share)
+registerWorkersCommand(program);
 // Cross-company group grants (subcommand group —
 // hq group-grants grant|revoke|outbound|inbound)
 registerGroupGrantsCommand(program);
@@ -147,6 +157,10 @@ registerGroupGrantsCommand(program);
 // browse-vs-sync subcommands (`hq files browse`/`cat`) onto the same group.
 const filesCmd = registerFilesCommand(program);
 registerFilesBrowseCommands(filesCmd);
+// Skill collaboration loop (subcommand group — hq skill suggest|list-suggestions|review).
+// A thin terminal front-end over the SAME wired hq-pro skill suggestion + merge
+// routes the MCP (US-007) and console merge (US-009) surfaces use — no forked logic.
+registerSkillCommand(program);
 // Membership management (subcommand group — hq members invite|list|revoke)
 registerMembersCommand(program);
 // People directory (subcommand group — hq people list|search|resolve), reading
@@ -164,6 +178,9 @@ registerMeetingsCommand(program);
 registerSourcesCommand(program);
 // Signals read surface (subcommand group — hq signals list|get|types|entities)
 registerSignalsCommand(program);
+// Company-connected apps via the governed integration gateway
+// (subcommand group — hq integrations list|tools|call|approve|reject)
+registerIntegrationsCommand(program);
 // Skill/personal-overlay mirroring + workers-registry regen. Invoked by the
 // hq-core reindex hook shim (Stop / PostToolUse) and by sync()/rescue() after
 // they change on-disk sources. Keeps a `master-sync` alias for one release.
@@ -184,6 +201,14 @@ registerCrmCommand(program);
 // Company settings (subcommand group — `hq company settings set`). Owner-only
 // toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
 registerCompanyCommand(program);
+// Cloud agent management (subcommand group — `hq agents …`). Rename, reconfigure,
+// start/stop, and tear down a company's fleet agents via the hq-pro /v1/agents
+// control plane — the same routes the web console's agents panel calls.
+registerAgentsCommand(program);
+// Personal Outpost management (subcommand group — `hq outposts …`). List, inspect,
+// enable Codex on, refresh login for, and destroy your EC2 boxes via the hq-pro
+// /outpost/* control plane.
+registerOutpostsCommand(program);
 export async function runCli() {
     try {
         Sentry.addBreadcrumb({
@@ -244,4 +269,4 @@ export async function runCli() {
     }
 }
 //# sourceMappingURL=main.js.map
-//# debugId=a2c1badb-d418-557d-a0f4-0e3defd13913
+//# debugId=d089113e-52b9-5313-a256-63f054d8e72a

package/dist/utils/cognito-session.js

@@ -19,7 +19,7 @@
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ab9733a5-3984-553b-8fcc-91b86d112c79")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f5342b2c-413d-5142-a44a-92788f273678")}catch(e){}}();
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -43,7 +43,7 @@ export const DEFAULT_COGNITO = {
         ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
         : "Google",
 };
-export const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ?? "https://hqapi.getindigo.ai";
+export const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
 /**
  * Resolve the HQ tree root for cloud-aware subcommands (`hq sync`, `hq onboard`,
  * `hq cloud …`, etc.).
@@ -375,4 +375,4 @@ export async function refreshCachedSession() {
     }
 }
 //# sourceMappingURL=cognito-session.js.map
-//# debugId=ab9733a5-3984-553b-8fcc-91b86d112c79
+//# debugId=f5342b2c-413d-5142-a44a-92788f273678