@indigoai-us/hq-cli 5.62.1 → 5.63.0

package/dist/commands/agents.d.ts

@@ -22,6 +22,7 @@
  * the caller's single active membership (same as `members.ts`).
  */
 import { Command } from "commander";
+import { type BillingErrorPayload } from "../utils/billing-gate.js";
 /** Reasoning-effort values hq-pro accepts on `runtime-config`. */
 export declare const VALID_EFFORTS: Set<string>;
 /** Service-tier (speed) values hq-pro accepts on `runtime-config`. */
@@ -35,7 +36,9 @@ export declare const VALID_TIERS: Set<string>;
 export declare class AgentsHttpError extends Error {
     status: number;
     code?: string;
-    constructor(status: number, message: string, code?: string);
+    /** hq-pro's billing envelope on a `402 billing_required` provision block. */
+    billing?: BillingErrorPayload;
+    constructor(status: number, message: string, code?: string, billing?: BillingErrorPayload);
 }
 /** Roster row from `GET /v1/agents` — a superset is returned; we keep what we render. */
 export interface CompanyAgentView {
@@ -79,6 +82,24 @@ export declare function agentsRequest<T>(opts: {
     body?: Record<string, unknown>;
     query?: Record<string, string>;
 }): Promise<T>;
+/** Slugify an agent name into a lowercase, hyphen-separated slug. */
+export declare function slugifyAgentName(name: string): string;
+export interface ProvisionAgentInput {
+    companyUid: string;
+    name: string;
+    slug: string;
+    codexAuthMode: "subscription" | "apiKey";
+    provider?: "codex" | "grok";
+    codexApiKey?: string;
+    idempotencyKey: string;
+    title?: string;
+    description?: string;
+}
+export declare function provisionAgent(token: string, input: ProvisionAgentInput): Promise<{
+    uid?: string;
+    slug?: string;
+    [key: string]: unknown;
+}>;
 export declare function listAgents(token: string, companyUid: string): Promise<CompanyAgentView[]>;
 export declare function getAgentStatus(token: string, agentUid: string): Promise<Record<string, unknown>>;
 export declare function patchAgentProfile(token: string, agentUid: string, patch: ProfilePatch): Promise<{

package/dist/commands/agents.js

@@ -22,10 +22,12 @@
  * the caller's single active membership (same as `members.ts`).
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8a374059-a137-5cce-94ad-9e2647fc37c5")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="581b1950-a9bc-50a4-b16b-6e6649e9db30")}catch(e){}}();
 import chalk from "chalk";
+import { randomUUID } from "node:crypto";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { AGENT_PRICE_CENTS, confirmChargeOrExit, parseBillingPayload, surfaceBillingRequired, } from "../utils/billing-gate.js";
 /** Reasoning-effort values hq-pro accepts on `runtime-config`. */
 export const VALID_EFFORTS = new Set([
     "minimal",
@@ -45,11 +47,14 @@ export const VALID_TIERS = new Set(["default", "priority"]);
 export class AgentsHttpError extends Error {
     status;
     code;
-    constructor(status, message, code) {
+    /** hq-pro's billing envelope on a `402 billing_required` provision block. */
+    billing;
+    constructor(status, message, code, billing) {
         super(message);
         this.name = "AgentsHttpError";
         this.status = status;
         this.code = code;
+        this.billing = billing;
     }
 }
 /**
@@ -61,10 +66,26 @@ export async function agentsRequest(opts) {
     const res = await vaultApiFetch(opts);
     if (!res.ok) {
         const body = (await res.json().catch(() => ({})));
-        throw new AgentsHttpError(res.status, body.error ?? body.message ?? res.statusText, body.code);
+        throw new AgentsHttpError(res.status, body.error ?? body.message ?? res.statusText, body.code, parseBillingPayload(body));
     }
     return (await res.json());
 }
+/** Slugify an agent name into a lowercase, hyphen-separated slug. */
+export function slugifyAgentName(name) {
+    return name
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
+export async function provisionAgent(token, input) {
+    return agentsRequest({
+        token,
+        path: "/v1/agents",
+        method: "POST",
+        body: input,
+    });
+}
 export async function listAgents(token, companyUid) {
     const data = await agentsRequest({
         token,
@@ -144,6 +165,79 @@ export function registerAgentsCommand(program) {
     // `hq agents --company acme list`.
     const companyOf = (sub) => sub.opts().company ??
         agents.opts().company;
+    agents
+        .command("provision <name>")
+        .alias("new")
+        .description("Provision a new cloud agent ($100/month — requires --yes)")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--slug <slug>", "Agent slug (defaults to a slug of <name>)")
+        .option("--provider <provider>", "Runtime: codex | grok (default codex)")
+        .option("--auth-mode <mode>", "Codex auth: subscription | apiKey (default subscription)", "subscription")
+        .option("--api-key-env <VAR>", "Env var holding the API key for --auth-mode apiKey (never pass the key as a flag)")
+        .option("--title <title>", "Org-chart job title")
+        .option("--description <text>", "Short description / bio")
+        .option("--yes", "Confirm the $100/month charge (required to provision)")
+        .action(async function (name, opts) {
+        try {
+            const authMode = opts.authMode === "apiKey" ? "apiKey" : "subscription";
+            const provider = opts.provider === "grok" ? "grok" : opts.provider ? "codex" : undefined;
+            // Resolve the API key from the environment (never from a flag value) when
+            // apiKey mode is requested — validated BEFORE the paid gate so we don't
+            // charge and then fail.
+            let codexApiKey;
+            if (authMode === "apiKey") {
+                const envVar = opts.apiKeyEnv;
+                if (!envVar) {
+                    console.error(chalk.red("--auth-mode apiKey requires --api-key-env <VAR> naming the env var that holds the key."));
+                    process.exit(1);
+                }
+                codexApiKey = process.env[envVar];
+                if (!codexApiKey) {
+                    console.error(chalk.red(`Env var ${envVar} is empty or unset — no API key to use.`));
+                    process.exit(1);
+                }
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getCompanyUid(token, companyOf(this));
+            // Paid gate: print the monthly cost and require --yes before any call.
+            confirmChargeOrExit({
+                resource: "agent",
+                unitCents: AGENT_PRICE_CENTS,
+                yes: opts.yes,
+            });
+            const slug = opts.slug ?? slugifyAgentName(name);
+            try {
+                const result = await provisionAgent(token, {
+                    companyUid,
+                    name,
+                    slug,
+                    codexAuthMode: authMode,
+                    ...(provider ? { provider } : {}),
+                    ...(codexApiKey ? { codexApiKey } : {}),
+                    idempotencyKey: `hq-cli-${randomUUID()}`,
+                    ...(opts.title ? { title: opts.title } : {}),
+                    ...(opts.description ? { description: opts.description } : {}),
+                });
+                const uid = typeof result.uid === "string" ? result.uid : slug;
+                console.log(chalk.green(`Provisioning started for agent "${name}".`));
+                console.log(chalk.dim(`Track setup: hq agents status ${uid} --company <slug>`));
+            }
+            catch (err) {
+                // No card on file → surface the shareable payment link instead of an
+                // opaque 402, then exit non-zero so scripts can react.
+                if (err instanceof AgentsHttpError &&
+                    err.status === 402 &&
+                    err.billing) {
+                    await surfaceBillingRequired(token, err.billing);
+                    process.exit(1);
+                }
+                throw err;
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
     agents
         .command("list")
         .description("List the company's agents")
@@ -382,4 +476,4 @@ export function registerAgentsCommand(program) {
     });
 }
 //# sourceMappingURL=agents.js.map
-//# debugId=8a374059-a137-5cce-94ad-9e2647fc37c5
+//# debugId=581b1950-a9bc-50a4-b16b-6e6649e9db30

package/dist/commands/billing.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `hq billing` — inspect billing state and mint a card-capture link from the
+ * terminal. Backs the paid-provisioning gate (agents & Outposts): a user can
+ * check whether a card is on file, and proactively hand out the same Stripe
+ * hosted card-capture link that a `402 billing_required` would surface.
+ *
+ * Targets the hq-pro billing control plane on `DEFAULT_VAULT_API_URL` via the
+ * shared `vaultApiFetch` helper — the same routes the console billing surfaces
+ * call.
+ *
+ * Subcommands:
+ *   hq billing status   [--company <slug>]              — subscription + card on file
+ *   hq billing checkout [--company <slug>] [--personal] — mint a card-capture link
+ */
+import { Command } from "commander";
+export declare function registerBillingCommand(program: Command): void;
+//# sourceMappingURL=billing.d.ts.map

package/dist/commands/billing.js

@@ -0,0 +1,114 @@
+/**
+ * `hq billing` — inspect billing state and mint a card-capture link from the
+ * terminal. Backs the paid-provisioning gate (agents & Outposts): a user can
+ * check whether a card is on file, and proactively hand out the same Stripe
+ * hosted card-capture link that a `402 billing_required` would surface.
+ *
+ * Targets the hq-pro billing control plane on `DEFAULT_VAULT_API_URL` via the
+ * shared `vaultApiFetch` helper — the same routes the console billing surfaces
+ * call.
+ *
+ * Subcommands:
+ *   hq billing status   [--company <slug>]              — subscription + card on file
+ *   hq billing checkout [--company <slug>] [--personal] — mint a card-capture link
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9a5d87b5-94d2-5893-8c48-af8db719fa05")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { mintPaymentLink } from "../utils/billing-gate.js";
+function fail(err) {
+    console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+    process.exit(1);
+}
+async function getBillingSummary(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/billing/summary",
+        query: { companyUid },
+    });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        throw new Error(body.error ?? body.message ?? res.statusText);
+    }
+    return (await res.json());
+}
+export function registerBillingCommand(program) {
+    const billing = program
+        .command("billing")
+        .description("Inspect billing and mint a card-capture link")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    const companyOf = (sub) => sub.opts().company ??
+        billing.opts().company;
+    billing
+        .command("status")
+        .description("Show subscription status and whether a card is on file")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const companyUid = await getCompanyUid(token, companyOf(this));
+            const summary = await getBillingSummary(token, companyUid);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(summary, null, 2) + "\n");
+                return;
+            }
+            const sub = summary.subscriptionStatus ?? "none";
+            console.log(`${chalk.bold("Subscription")}: ${sub}`);
+            const pm = summary.defaultPaymentMethod;
+            if (pm?.present) {
+                const detail = pm.brand && pm.last4 ? `${pm.brand} ••••${pm.last4}` : "on file";
+                console.log(`${chalk.bold("Card")}: ${detail}`);
+            }
+            else {
+                console.log(`${chalk.bold("Card")}: ${chalk.yellow("no card on file")} — ` +
+                    `run \`hq billing checkout\` to add one before provisioning paid resources.`);
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    billing
+        .command("checkout")
+        .description("Mint a Stripe card-capture link (shareable) to add a card")
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--personal", "Mint the link for your personal payer (Outposts) instead of a company")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            let setup;
+            if (opts.personal) {
+                setup = {
+                    payerType: "person",
+                    path: "/v1/billing/checkout/person",
+                    method: "POST",
+                };
+            }
+            else {
+                const companyUid = await getCompanyUid(token, companyOf(this));
+                setup = {
+                    payerType: "company",
+                    path: "/v1/billing/checkout/org",
+                    method: "POST",
+                    body: { companyUid },
+                };
+            }
+            const url = await mintPaymentLink(token, setup);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify({ url }, null, 2) + "\n");
+                return;
+            }
+            console.log("Add a card here (safe to share with whoever owns billing):\n  " +
+                chalk.cyan(url));
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=billing.js.map
+//# debugId=9a5d87b5-94d2-5893-8c48-af8db719fa05

package/dist/commands/cloud.d.ts

@@ -66,6 +66,17 @@ export interface SyncCallOptions {
      */
     syncMode?: SyncMode;
     prefixSet?: string[];
+    /**
+     * Company-relative prefixes the pull must NOT materialize even when the
+     * caller's STS scope is wide enough to read them (sessions-exclusion /
+     * company-work-corpus). Derived by `resolvePullScope` in the hq-cloud release
+     * carrying the sessions/ pull-exclusion, forwarded to `sync()` here so the CLI
+     * honors the same "session transcripts never sync DOWN" invariant the
+     * background sync engine enforces. A company OWNER can read `sessions/` keys,
+     * so without this the CLI would bulk-download everyone's full-content session
+     * transcripts to local disk. Undefined/empty ⇒ nothing excluded (legacy).
+     */
+    excludePrefixes?: string[];
     /** Honor a `--force-scope-shrink` on a foreground pull (dirty files kept). */
     forceScopeShrink?: boolean;
 }

package/dist/commands/cloud.js

@@ -13,7 +13,7 @@
  *   hq sync status            — show local journal summary
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fa72780b-ae22-5125-98b6-4e7b866b7d17")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5e2703d2-1874-5625-8508-67ff641ff1a6")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
@@ -74,6 +74,25 @@ function pickCanonicalPerson(persons) {
         return a.uid < b.uid ? -1 : 1;
     })[0];
 }
+/**
+ * Read the sessions-exclusion prefix set off a resolved {@link PullScope}.
+ *
+ * `resolvePullScope` in hq-cloud derives the sessions/ pull-exclusion and
+ * derives `excludePrefixes` (e.g. `["sessions/"]`) so a company OWNER — whose STS
+ * scope is wide enough to read `sessions/` keys — does not bulk-download
+ * everyone's full-content session transcripts to local disk, upholding the
+ * "session transcripts never sync DOWN" invariant hq-cloud enforces for the
+ * background engine. Keep the small runtime shape check even though PullScope
+ * now declares the field: it protects the CLI when an older external resolver
+ * implementation is injected by tests or downstream callers.
+ */
+function readScopeExcludePrefixes(scope) {
+    const raw = scope?.excludePrefixes;
+    if (!Array.isArray(raw))
+        return undefined;
+    const prefixes = raw.filter((p) => typeof p === "string" && p.length > 0);
+    return prefixes.length > 0 ? prefixes : undefined;
+}
 export async function pullAll(options, deps) {
     const memberships = await deps.vaultClient.listMyMemberships();
     const persons = await deps.vaultClient.listPersonEntities();
@@ -145,6 +164,12 @@ export async function pullAll(options, deps) {
                 if (scope.prefixSet !== undefined) {
                     entry.syncOptions.prefixSet = scope.prefixSet;
                 }
+                // Sessions-exclusion: thread the resolver's excludePrefixes into the
+                // pull so a wide-STS OWNER never bulk-downloads session transcripts.
+                const excludePrefixes = readScopeExcludePrefixes(scope);
+                if (excludePrefixes) {
+                    entry.syncOptions.excludePrefixes = excludePrefixes;
+                }
             }
             catch {
                 resolvedMode = undefined;
@@ -742,6 +767,7 @@ export function registerCloudCommands(program) {
                     "to migrate, or re-run with --mode-all."));
                 process.exit(1);
             }
+            const excludePrefixes = readScopeExcludePrefixes(pullScope);
             const result = await sync({
                 company: options.company,
                 onConflict: options.onConflict,
@@ -753,6 +779,9 @@ export function registerCloudCommands(program) {
                 ...(pullScope?.prefixSet !== undefined
                     ? { prefixSet: pullScope.prefixSet }
                     : {}),
+                // Sessions-exclusion: never materialize excluded prefixes even for
+                // a wide-STS owner.
+                ...(excludePrefixes ? { excludePrefixes } : {}),
                 ...(options.forceScopeShrink ? { forceScopeShrink: true } : {}),
             });
             if (result.aborted) {
@@ -944,6 +973,11 @@ async function runPullAll(hqRoot, onConflict, modeAllOverride, skipPersonal, for
                     : {}),
                 ...(opts.syncMode !== undefined ? { syncMode: opts.syncMode } : {}),
                 ...(opts.prefixSet !== undefined ? { prefixSet: opts.prefixSet } : {}),
+                // Sessions-exclusion: forward the per-company excludePrefixes that
+                // pullAll stamped onto SyncCallOptions into the real hq-cloud sync().
+                ...(opts.excludePrefixes?.length
+                    ? { excludePrefixes: opts.excludePrefixes }
+                    : {}),
                 ...(opts.forceScopeShrink ? { forceScopeShrink: true } : {}),
             }),
         });
@@ -1226,6 +1260,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             }
         }
         console.log(chalk.dim("  → pull leg"));
+        const excludePrefixes = readScopeExcludePrefixes(pullScope);
         const pullResult = await sync({
             company: targetCompany,
             vaultConfig,
@@ -1239,6 +1274,9 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             ...(pullScope?.prefixSet !== undefined
                 ? { prefixSet: pullScope.prefixSet }
                 : {}),
+            // Sessions-exclusion: honor the resolver's excludePrefixes on the
+            // `hq sync now` pull leg too.
+            ...(excludePrefixes ? { excludePrefixes } : {}),
             ...(forceScopeShrink ? { forceScopeShrink: true } : {}),
         });
         console.log(`    ${pullResult.aborted ? chalk.yellow("⚠") : chalk.green("✓")} ` +
@@ -1368,4 +1406,4 @@ function resolveUploadAuthorFromCache() {
     }
 }
 //# sourceMappingURL=cloud.js.map
-//# debugId=fa72780b-ae22-5125-98b6-4e7b866b7d17
+//# debugId=5e2703d2-1874-5625-8508-67ff641ff1a6

package/dist/commands/members.d.ts

@@ -1,5 +1,7 @@
 import { Command } from "commander";
 export declare const VALID_ROLES: Set<string>;
+/** Roles allowed when inviting an existing fleet agent into a company. */
+export declare const AGENT_INVITE_ROLES: Set<string>;
 export type Role = "owner" | "admin" | "member" | "guest";
 export interface PendingInvite {
     membershipKey: string;
@@ -81,6 +83,13 @@ export interface InviteResult {
     emailSkipped?: boolean;
     /** Resend was attempted but failed — human-readable reason. */
     emailError?: string;
+    /**
+     * Present when hq-pro treated the target as a fleet agent (guest invite).
+     * Always `false` on the agent path — host keeps billing.
+     */
+    activationBilled?: boolean;
+    /** Host company uid when the server returned an agent guest-invite result. */
+    hostCompanyUid?: string;
 }
 export interface ResendInviteOptions {
     inviteeEmail: string;
@@ -100,8 +109,10 @@ export interface ResendInviteResult {
     emailError?: string;
 }
 export interface DetectedTarget {
-    type: "email" | "person";
+    type: "email" | "person" | "agent";
     value: string;
+    /** True when the target is a fleet agent (uid or machine email). */
+    isAgent?: boolean;
 }
 export declare function detectTarget(target: string): DetectedTarget | null;
 export declare function shortDate(iso: string): string;

package/dist/commands/members.js

@@ -1,17 +1,33 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e3c1d5a2-b7f4-5f0f-8603-000df9bcca33")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="09a00ce0-be62-5739-9816-042dda515518")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
+const AGENT_UID_PATTERN = /^agt_[A-Za-z0-9_-]+$/i;
+/** Fleet agent machine email: agt-…@agents.getindigo.ai */
+const AGENT_EMAIL_PATTERN = /^agt-[a-z0-9]+@agents\.getindigo\.ai$/i;
 export const VALID_ROLES = new Set(["owner", "admin", "member", "guest"]);
+/** Roles allowed when inviting an existing fleet agent into a company. */
+export const AGENT_INVITE_ROLES = new Set(["admin", "member"]);
 export function detectTarget(target) {
-    if (EMAIL_PATTERN.test(target)) {
-        return { type: "email", value: target.trim().toLowerCase() };
+    const trimmed = target.trim();
+    if (AGENT_UID_PATTERN.test(trimmed)) {
+        return { type: "agent", value: trimmed, isAgent: true };
     }
-    if (PERSON_UID_PATTERN.test(target)) {
-        return { type: "person", value: target };
+    if (AGENT_EMAIL_PATTERN.test(trimmed)) {
+        return {
+            type: "email",
+            value: trimmed.toLowerCase(),
+            isAgent: true,
+        };
+    }
+    if (EMAIL_PATTERN.test(trimmed)) {
+        return { type: "email", value: trimmed.toLowerCase() };
+    }
+    if (PERSON_UID_PATTERN.test(trimmed)) {
+        return { type: "person", value: trimmed };
     }
     return null;
 }
@@ -45,9 +61,24 @@ export async function inviteMember(options) {
     }
     const detected = detectTarget(options.target);
     if (!detected) {
-        throw new Error(`Invalid target '${options.target}': must be an email address or a personUid matching prs_<alphanumeric>`);
+        throw new Error(`Invalid target '${options.target}': must be an email, personUid (prs_…), agent uid (agt_…), or agent email (agt-…@agents.getindigo.ai)`);
+    }
+    // Fleet agents: same invite command as humans, but only member|admin.
+    // Host company keeps billing — server never double-bills on guest invite.
+    if (detected.isAgent) {
+        if (!AGENT_INVITE_ROLES.has(options.role)) {
+            throw new Error(`Agents can only be invited as member or admin (got '${options.role}'). Host company keeps billing.`);
+        }
+        if (options.paths) {
+            throw new Error("--paths / guest role is not valid for agents — invite as member or admin");
+        }
+        if (options.groupIds && options.groupIds.length > 0) {
+            throw new Error("--groups is not supported on agent invites — share secrets after membership with `hq secrets share`");
+        }
     }
-    if (options.groupIds && options.groupIds.length > 0 && detected.type === "person") {
+    if (options.groupIds &&
+        options.groupIds.length > 0 &&
+        (detected.type === "person" || detected.type === "agent")) {
         throw new Error("--groups is only valid on email-keyed invites (server rejects personUid + groupIds with 400)");
     }
     const allowedPrefixes = options.paths
@@ -108,6 +139,12 @@ export async function inviteMember(options) {
             ? { emailSkipped: data.emailSkipped }
             : {}),
         ...(data.emailError ? { emailError: data.emailError } : {}),
+        ...(typeof data.activationBilled === "boolean"
+            ? { activationBilled: data.activationBilled }
+            : {}),
+        ...(typeof data.hostCompanyUid === "string"
+            ? { hostCompanyUid: data.hostCompanyUid }
+            : {}),
     };
 }
 /**
@@ -230,9 +267,17 @@ export function resolveRevokeTargetToMembershipKey(arg, companyUid) {
         return arg;
     const detected = detectTarget(arg);
     if (detected?.type === "email") {
+        // Active agent guest memberships are personUid-keyed (agt_…#cmp_…), not
+        // email-keyed. Map machine emails to that key so revoke works after invite.
+        if (detected.isAgent) {
+            const local = detected.value.split("@")[0] ?? "";
+            const m = local.match(/^agt-(.+)$/i);
+            if (m)
+                return `agt_${m[1].toUpperCase()}#${companyUid}`;
+        }
         return `email:${detected.value}#${companyUid}`;
     }
-    if (detected?.type === "person") {
+    if (detected?.type === "person" || detected?.type === "agent") {
         return `${detected.value}#${companyUid}`;
     }
     return arg;
@@ -337,8 +382,8 @@ export function registerMembersCommand(program) {
     });
     members
         .command("invite <target>")
-        .description("Invite a person to the company by email or personUid (sends an invitation email by default)")
-        .option("--role <role>", "Role for the invitee: owner, admin, member, or guest", "member")
+        .description("Invite a person or fleet agent to the company. People: email or prs_…. Agents: agt_… or agt-…@agents.getindigo.ai (member|admin; host keeps billing, no double charge).")
+        .option("--role <role>", "Role: person → owner|admin|member|guest; agent → member|admin only", "member")
         .option("--paths <prefixes>", "Comma-separated allowed prefixes (only valid with --role guest)")
         .option("--groups <ids>", "Comma-separated secret-group ids the invitee will be added to on claim (email-keyed invites only)")
         .option("--send-email", "Have hq-pro send an invitation email via Resend (default true for email-keyed invites). Pre-resend hq-pro versions ignore this and the legacy 'no email sent' instructions print instead.", true)
@@ -376,12 +421,34 @@ export function registerMembersCommand(program) {
                 role: opts.role,
                 paths: opts.paths,
                 groupIds,
-                sendEmail: opts.sendEmail,
+                // Agents join actively — no Resend email.
+                sendEmail: detectTarget(target)?.isAgent ? false : opts.sendEmail,
                 companyUid,
                 callerUid,
                 token,
             });
+            const agentTarget = detectTarget(target)?.isAgent === true;
             console.log(chalk.green(`Invited ${target} as ${result.membership.role} (status: ${result.membership.status})`));
+            // Agent path is confirmed only when the server returned the guest-invite
+            // envelope (activationBilled present) AND status is active. A pending
+            // row means this hq-pro stage has not rolled the agent invite path yet —
+            // do NOT claim active join / no-double-bill.
+            if (agentTarget &&
+                result.membership.status === "active" &&
+                typeof result.activationBilled === "boolean") {
+                console.log(chalk.dim(`Fleet agent: active membership granted immediately` +
+                    (result.hostCompanyUid
+                        ? ` (host ${result.hostCompanyUid} keeps billing)`
+                        : " (host keeps billing, no double charge)") +
+                    `. Next: share secrets / vault paths as needed (\`hq secrets share\`, \`/new-agent\`).`));
+                console.log();
+                return;
+            }
+            if (agentTarget && result.membership.status !== "active") {
+                console.log(chalk.yellow("⚠ Agent invite landed as a pending membership — this hq-pro stage may not yet have multi-company agent invite. Wait for prod deploy of the agent membership path, then re-invite (or revoke this pending row)."));
+                console.log();
+                return;
+            }
             console.log();
             if (result.magicLink) {
                 // Legacy server schema — magic-link redemption.
@@ -564,4 +631,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=e3c1d5a2-b7f4-5f0f-8603-000df9bcca33
+//# debugId=09a00ce0-be62-5739-9816-042dda515518

package/dist/commands/outposts.d.ts

@@ -21,11 +21,14 @@
  * and status routes that exist. Renaming an Outpost is not a backend capability.
  */
 import { Command } from "commander";
+import { type BillingErrorPayload } from "../utils/billing-gate.js";
 /** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
 export declare class OutpostHttpError extends Error {
     status: number;
     step?: string;
-    constructor(status: number, message: string, step?: string);
+    /** hq-pro's billing envelope on a `402 billing_required` provision block. */
+    billing?: BillingErrorPayload;
+    constructor(status: number, message: string, step?: string, billing?: BillingErrorPayload);
 }
 /** Row summary from `GET /outpost/list`. */
 export interface OutpostSummary {
@@ -49,8 +52,22 @@ export declare function outpostRequest<T>(opts: {
     token: string;
     path: string;
     method?: string;
+    body?: Record<string, unknown>;
     query?: Record<string, string>;
 }): Promise<T>;
+/**
+ * Provision the caller's Outpost. Sends the cached Cognito refresh token so the
+ * box can authenticate AS the caller (the same body the console's
+ * `provisionMyOutpost` sends). Idempotent server-side: a caller already at their
+ * per-person cap gets their existing box back rather than a duplicate. The
+ * refresh token is sent over HTTPS and NEVER printed.
+ */
+export declare function provisionOutpost(token: string, input: {
+    refreshToken: string;
+    clientIp?: string;
+    diskSizeGb?: number;
+    agentRuntime?: "claude" | "codex";
+}): Promise<Record<string, unknown>>;
 export declare function listOutposts(token: string): Promise<OutpostSummary[]>;
 export declare function getOutpostStatus(token: string, outpostId?: string): Promise<Record<string, unknown>>;
 export declare function enableCodex(token: string, outpostId?: string): Promise<Record<string, unknown>>;