@indigoai-us/hq-cli 5.77.0 → 5.77.2

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [5.77.2]
+
+### Fixed
+
+- `hq auth login` now recognizes callback-port collisions and provides recovery
+  guidance instead of surfacing a raw bind exception.
+- `hq company settings set --accounting-enabled <true|false>` now forwards the
+  accounting setting to the server, restoring the documented accounting
+  activation path.
+
+## [5.77.1]
+
+### Fixed
+
+- Missing company-slug responses are classified as expected user errors, so the
+  CLI no longer sends this expected absence to Sentry.
+
 ## [5.71.0]
 
 ### Added

package/dist/commands/auth.js

@@ -15,7 +15,7 @@
  */
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, isMachineIdentity, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
-import { refreshCachedSession, } from "../utils/cognito-session.js";
+import { DEFAULT_COGNITO, refreshCachedSession, } from "../utils/cognito-session.js";
 import { cognitoConfigForLoginProvider } from "../utils/login-provider.js";
 /**
  * Decode the (unverified) ID token payload for display purposes only.
@@ -46,6 +46,17 @@ function machineIdentityLabel() {
     const creds = loadMachineCreds();
     return creds ? `machine identity ${creds.username}` : "machine identity";
 }
+function isCallbackPortCollision(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const { code, message } = error;
+    return code === "EADDRINUSE" || message?.includes("EADDRINUSE") === true;
+}
+function callbackPortCollisionGuidance(port) {
+    return (`  The browser-login callback port (127.0.0.1:${port}) is already in use. ` +
+        "Another `hq auth login` may still be waiting for browser sign-in. Finish that login, " +
+        "or stop its terminal/process, then retry.");
+}
 export function registerAuthCommands(program) {
     const authCmd = program
         .command("auth")
@@ -72,13 +83,21 @@ export function registerAuthCommands(program) {
             console.log(chalk.dim(`  Token cached at ~/.hq/cognito-tokens.json (expires ${tokens.expiresAt})`));
         }
         catch (err) {
-            const msg = err instanceof CognitoAuthError
-                ? err.message
-                : err instanceof Error
+            const callbackPortCollision = isCallbackPortCollision(err);
+            const msg = callbackPortCollision
+                ? "Browser-login callback port is already in use."
+                : err instanceof CognitoAuthError
                     ? err.message
-                    : String(err);
+                    : err instanceof Error
+                        ? err.message
+                        : String(err);
             console.error(chalk.red(`Login failed: ${msg}`));
-            console.error(chalk.dim("  If you do not have an account, sign up at https://onboarding.indigo-hq.com"));
+            if (callbackPortCollision) {
+                console.error(chalk.dim(callbackPortCollisionGuidance(DEFAULT_COGNITO.port ?? 8765)));
+            }
+            else {
+                console.error(chalk.dim("  If you do not have an account, sign up at https://onboarding.indigo-hq.com"));
+            }
             process.exit(1);
         }
     });

package/dist/commands/cloud.d.ts

@@ -22,6 +22,13 @@ import { type BannerLevel } from "../lib/narrow-hint-banner.js";
  * succeed when files were dropped" guarantee unit-testable.
  */
 export declare function scopeExcludedWarning(count: number): string | null;
+/**
+ * Bound foreground waits for a watcher/manual sync that currently owns the
+ * per-root operation lock. The cloud engine reads this environment value on
+ * every lock acquisition. A command-line value wins; otherwise preserve a
+ * valid explicit caller environment value and supply a finite CLI default.
+ */
+export declare function configureSyncLockTimeout(raw: string | undefined): void;
 export interface PullAllVaultClient {
     listMyMemberships(): Promise<Array<{
         companyUid: string;

package/dist/commands/cloud.js

@@ -59,6 +59,21 @@ function resolveDeletePolicy() {
     }
     return "currency-gated";
 }
+const DEFAULT_SYNC_LOCK_TIMEOUT_SECONDS = 300;
+/**
+ * Bound foreground waits for a watcher/manual sync that currently owns the
+ * per-root operation lock. The cloud engine reads this environment value on
+ * every lock acquisition. A command-line value wins; otherwise preserve a
+ * valid explicit caller environment value and supply a finite CLI default.
+ */
+export function configureSyncLockTimeout(raw) {
+    const value = raw ?? process.env.HQ_OP_LOCK_TIMEOUT ?? String(DEFAULT_SYNC_LOCK_TIMEOUT_SECONDS);
+    const seconds = Number(value);
+    if (!Number.isInteger(seconds) || seconds < 0) {
+        throw new Error("--lock-timeout must be a non-negative integer number of seconds");
+    }
+    process.env.HQ_OP_LOCK_TIMEOUT = String(seconds);
+}
 // Oldest-first by createdAt, ties broken by uid lexicographic — matches
 // `pickCanonicalPersonEntity` in @indigoai-us/hq-cloud so the CLI lands on
 // the same person bucket that `hq-sync-runner` picks.
@@ -478,6 +493,7 @@ export function registerCloudCommands(program) {
         .argument("[paths...]", "Paths to push (defaults to current directory)")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
+        .option("--lock-timeout <seconds>", "Maximum wait for another active HQ operation (default: 300; 0 = refuse immediately)")
         .option("--message <msg>", "Optional message attached to journal entries for these uploads")
         .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
         .option("--creds-from-stdin", "Read a pre-vended EntityContext as JSON from stdin instead of vending " +
@@ -509,6 +525,7 @@ export function registerCloudCommands(program) {
         "`--all`.")
         .action(async (paths, options) => {
         try {
+            configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "push");
         }
         catch (err) {
@@ -688,6 +705,7 @@ export function registerCloudCommands(program) {
         .description("Pull permitted files from the company vault to local HQ")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
+        .option("--lock-timeout <seconds>", "Maximum wait for another active HQ operation (default: 300; 0 = refuse immediately)")
         .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
         .option("--all", "Pull every company you are a member of plus your personal vault " +
         "into <hq-root>. Companies land at <hq-root>/companies/<slug>; " +
@@ -711,6 +729,7 @@ export function registerCloudCommands(program) {
         "quarantined under .hq/scope-quarantine/ (recoverable).")
         .action(async (options) => {
         try {
+            configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "pull");
         }
         catch (err) {
@@ -882,6 +901,7 @@ export function registerCloudCommands(program) {
         "(mirrors AppBar HQ Sync's \"Sync Now\" button)")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .option("--company <slug>", "Company slug or UID (defaults to active company in .hq/config.json)")
+        .option("--lock-timeout <seconds>", "Maximum wait for another active HQ operation (default: 300; 0 = refuse immediately)")
         .option("--message <msg>", "Optional message attached to journal entries for the push leg")
         .option("--on-conflict <strategy>", "Conflict strategy: overwrite | keep | abort (omit for interactive)")
         .option("--all", "Sync every company you are a member of plus your personal vault " +
@@ -901,6 +921,7 @@ export function registerCloudCommands(program) {
         "out-of-scope files are quarantined under .hq/scope-quarantine/.")
         .action(async (options) => {
         try {
+            configureSyncLockTimeout(options.lockTimeout);
             assertSingleSelector(options, "now");
             if (options.all) {
                 // `options.personal === false` is Commander's auto-negation

package/dist/commands/company.js

@@ -25,9 +25,10 @@ export function registerCompanyCommand(program) {
     settings
         .command("set")
         .description("Set per-company settings (PUT /company-settings). Require at least one " +
-        "of --crm-enabled / --ontology-enabled.")
+        "of --crm-enabled / --ontology-enabled / --accounting-enabled.")
         .option("--crm-enabled <true|false>", "Enable/disable the native CRM for this company")
         .option("--ontology-enabled <true|false>", "Enable/disable the ontology gardener for this company")
+        .option("--accounting-enabled <true|false>", "Enable/disable the accounting pack for this company")
         .action(async (opts) => {
         try {
             const companySlug = company.opts().company;
@@ -35,8 +36,10 @@ export function registerCompanyCommand(program) {
                 console.error(chalk.red("Error: --company <slug> is required."));
                 process.exit(1);
             }
-            if (opts.crmEnabled === undefined && opts.ontologyEnabled === undefined) {
-                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled."));
+            if (opts.crmEnabled === undefined &&
+                opts.ontologyEnabled === undefined &&
+                opts.accountingEnabled === undefined) {
+                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled."));
                 process.exit(1);
             }
             const body = {};
@@ -46,6 +49,9 @@ export function registerCompanyCommand(program) {
             if (opts.ontologyEnabled !== undefined) {
                 body.ontologyEnabled = parseBoolFlag(opts.ontologyEnabled, "--ontology-enabled");
             }
+            if (opts.accountingEnabled !== undefined) {
+                body.accountingEnabled = parseBoolFlag(opts.accountingEnabled, "--accounting-enabled");
+            }
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, { companySlug });
             body.companyUid = companyUid;

package/dist/main.js

@@ -67,6 +67,9 @@ import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check
 import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { emitCliSessionStarted } from "./utils/cli-telemetry.js";
+import { settleWithin } from "./utils/settle-with-timeout.js";
+/** Hard upper bound for non-user-visible release-health finalization. */
+const RELEASE_HEALTH_SETTLE_TIMEOUT_MS = 3_000;
 // Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes
 // the pipe early. This covers the ASYNC path — an 'error' event emitted on the
 // stream. The SYNCHRONOUS path (a `write EPIPE` thrown straight out of
@@ -306,7 +309,11 @@ export async function runCli() {
     finally {
         // Release health: finalize the per-run session before the flush.
         Sentry.endSession();
-        await Promise.allSettled([refreshVersionCache(), Sentry.flush(2000)]);
+        // Neither task may turn a successful command into Node's
+        // `unsettled top-level await` exit. They are observability-only after the
+        // command has completed, so a bounded best-effort wait is the terminal
+        // lifecycle boundary for this invocation.
+        await settleWithin([refreshVersionCache(), Sentry.flush(2000)], RELEASE_HEALTH_SETTLE_TIMEOUT_MS);
     }
 }
 //# sourceMappingURL=main.js.map

package/dist/utils/settle-with-timeout.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Await finalization work without allowing a best-effort promise to leave a
+ * CLI's top-level await pending forever. The timer intentionally stays
+ * referenced: Node must remain alive long enough to settle this race.
+ */
+export declare function settleWithin(promises: readonly Promise<unknown>[], timeoutMs: number): Promise<"settled" | "timed_out">;
+//# sourceMappingURL=settle-with-timeout.d.ts.map

package/dist/utils/settle-with-timeout.js

@@ -0,0 +1,22 @@
+/**
+ * Await finalization work without allowing a best-effort promise to leave a
+ * CLI's top-level await pending forever. The timer intentionally stays
+ * referenced: Node must remain alive long enough to settle this race.
+ */
+export async function settleWithin(promises, timeoutMs) {
+    let timer;
+    const timedOut = new Promise((resolve) => {
+        timer = setTimeout(() => resolve("timed_out"), timeoutMs);
+    });
+    try {
+        return await Promise.race([
+            Promise.allSettled(promises).then(() => "settled"),
+            timedOut,
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=settle-with-timeout.js.map

package/dist/utils/vault-api.js

@@ -176,6 +176,9 @@ async function resolveCompanyUid(token, ref) {
                 `is in your namespace. Re-run with --company <uid> to pick one:\n` +
                 body.uids.map((u) => `  --company ${u}`).join('\n'));
         }
+        if (res.status === 404 && body.error === "Entity not found") {
+            throw Object.assign(new Error(`Company slug '${ref}' was not found. Check the slug or run \`hq companies list\`.`), { expected: true });
+        }
         throw new Error(`Failed to resolve company slug '${ref}': ${body.error ?? res.statusText}`);
     }
     const data = (await res.json());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.77.0",
+  "version": "5.77.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/auth.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, it, vi } from "vitest";
+import { Command } from "commander";
+
+const mocks = vi.hoisted(() => ({
+  browserLogin: vi.fn(),
+  isExpiring: vi.fn(),
+  isMachineIdentity: vi.fn(),
+  loadCachedTokens: vi.fn(),
+  loadMachineCreds: vi.fn(),
+  CognitoAuthError: class TestCognitoAuthError extends Error {},
+}));
+
+vi.mock("@indigoai-us/hq-cloud", () => ({
+  browserLogin: mocks.browserLogin,
+  clearCachedTokens: vi.fn(),
+  isExpiring: mocks.isExpiring,
+  isMachineIdentity: mocks.isMachineIdentity,
+  loadCachedTokens: mocks.loadCachedTokens,
+  loadMachineCreds: mocks.loadMachineCreds,
+  CognitoAuthError: mocks.CognitoAuthError,
+}));
+
+vi.mock("../utils/cognito-session.js", () => ({
+  DEFAULT_COGNITO: {
+    region: "us-east-1",
+    userPoolDomain: "vault-indigo-hq-prod",
+    clientId: "client-123",
+    port: 8765,
+    identityProvider: "Google",
+  },
+  refreshCachedSession: vi.fn(),
+}));
+
+import { registerAuthCommands } from "./auth.js";
+
+class ProcessExitError extends Error {
+  constructor(readonly code: number) {
+    super(`process.exit(${code})`);
+  }
+}
+
+describe("hq auth login", () => {
+  it("REGRESSION: explains how to recover when the callback port is held by another login", async () => {
+    mocks.isMachineIdentity.mockReturnValue(false);
+    mocks.loadCachedTokens.mockReturnValue(undefined);
+    mocks.browserLogin.mockRejectedValue(
+      Object.assign(new Error("listen EADDRINUSE: address already in use 127.0.0.1:8765"), {
+        code: "EADDRINUSE",
+      }),
+    );
+
+    const errors: string[] = [];
+    const errorSpy = vi
+      .spyOn(console, "error")
+      .mockImplementation((...args: unknown[]) => errors.push(args.map(String).join(" ")));
+    const exitSpy = vi
+      .spyOn(process, "exit")
+      .mockImplementation(((code?: number) => {
+        throw new ProcessExitError(code ?? 0);
+      }) as never);
+    const program = new Command();
+    program.exitOverride();
+    registerAuthCommands(program);
+
+    try {
+      await expect(program.parseAsync(["auth", "login"], { from: "user" })).rejects.toMatchObject({
+        code: 1,
+      });
+    } finally {
+      errorSpy.mockRestore();
+      exitSpy.mockRestore();
+    }
+
+    const output = errors.join("\n");
+    expect(output).toContain("Login failed: Browser-login callback port is already in use.");
+    expect(output).not.toContain("EADDRINUSE");
+    expect(output).toContain("callback port (127.0.0.1:8765) is already in use");
+    expect(output).toContain("Another `hq auth login` may still be waiting");
+    expect(output).toContain("stop its terminal/process, then retry");
+    expect(output).not.toContain("sign up at");
+  });
+});

package/src/commands/auth.ts

@@ -66,6 +66,20 @@ function machineIdentityLabel(): string {
   return creds ? `machine identity ${creds.username}` : "machine identity";
 }
 
+function isCallbackPortCollision(error: unknown): boolean {
+  if (!error || typeof error !== "object") return false;
+  const { code, message } = error as NodeJS.ErrnoException;
+  return code === "EADDRINUSE" || message?.includes("EADDRINUSE") === true;
+}
+
+function callbackPortCollisionGuidance(port: number): string {
+  return (
+    `  The browser-login callback port (127.0.0.1:${port}) is already in use. ` +
+    "Another `hq auth login` may still be waiting for browser sign-in. Finish that login, " +
+    "or stop its terminal/process, then retry."
+  );
+}
+
 export function registerAuthCommands(program: Command): void {
   const authCmd = program
     .command("auth")
@@ -105,18 +119,27 @@ export function registerAuthCommands(program: Command): void {
           chalk.dim(`  Token cached at ~/.hq/cognito-tokens.json (expires ${tokens.expiresAt})`),
         );
       } catch (err) {
+        const callbackPortCollision = isCallbackPortCollision(err);
         const msg =
-          err instanceof CognitoAuthError
-            ? err.message
-            : err instanceof Error
+          callbackPortCollision
+            ? "Browser-login callback port is already in use."
+            : err instanceof CognitoAuthError
               ? err.message
-              : String(err);
+              : err instanceof Error
+                ? err.message
+                : String(err);
         console.error(chalk.red(`Login failed: ${msg}`));
-        console.error(
-          chalk.dim(
-            "  If you do not have an account, sign up at https://onboarding.indigo-hq.com",
-          ),
-        );
+        if (callbackPortCollision) {
+          console.error(
+            chalk.dim(callbackPortCollisionGuidance(DEFAULT_COGNITO.port ?? 8765)),
+          );
+        } else {
+          console.error(
+            chalk.dim(
+              "  If you do not have an account, sign up at https://onboarding.indigo-hq.com",
+            ),
+          );
+        }
         process.exit(1);
       }
     });

package/src/commands/cloud.test.ts

@@ -0,0 +1,41 @@
+import { afterEach, describe, expect, it } from "vitest";
+
+import { configureSyncLockTimeout } from "./cloud.js";
+
+const originalLockTimeout = process.env.HQ_OP_LOCK_TIMEOUT;
+
+afterEach(() => {
+  if (originalLockTimeout === undefined) {
+    delete process.env.HQ_OP_LOCK_TIMEOUT;
+  } else {
+    process.env.HQ_OP_LOCK_TIMEOUT = originalLockTimeout;
+  }
+});
+
+describe("configureSyncLockTimeout", () => {
+  it("supplies a finite foreground wait when the caller has not configured one", () => {
+    delete process.env.HQ_OP_LOCK_TIMEOUT;
+    configureSyncLockTimeout(undefined);
+    expect(process.env.HQ_OP_LOCK_TIMEOUT).toBe("300");
+  });
+
+  it("honors an explicit zero-second refusal", () => {
+    configureSyncLockTimeout("0");
+    expect(process.env.HQ_OP_LOCK_TIMEOUT).toBe("0");
+  });
+
+  it("honors a valid inherited lock timeout", () => {
+    process.env.HQ_OP_LOCK_TIMEOUT = "17";
+    configureSyncLockTimeout(undefined);
+    expect(process.env.HQ_OP_LOCK_TIMEOUT).toBe("17");
+  });
+
+  it("rejects an invalid timeout instead of silently waiting forever", () => {
+    expect(() => configureSyncLockTimeout("forever")).toThrow("--lock-timeout");
+  });
+
+  it("rejects an invalid inherited timeout instead of restoring an infinite wait", () => {
+    process.env.HQ_OP_LOCK_TIMEOUT = "forever";
+    expect(() => configureSyncLockTimeout(undefined)).toThrow("--lock-timeout");
+  });
+});

package/src/commands/cloud.ts

@@ -97,6 +97,24 @@ function resolveDeletePolicy(): "owned-only" | "currency-gated" | "all" {
 interface CommonSyncOptions {
   hqRoot: string;
   company?: string;
+  lockTimeout?: string;
+}
+
+const DEFAULT_SYNC_LOCK_TIMEOUT_SECONDS = 300;
+
+/**
+ * Bound foreground waits for a watcher/manual sync that currently owns the
+ * per-root operation lock. The cloud engine reads this environment value on
+ * every lock acquisition. A command-line value wins; otherwise preserve a
+ * valid explicit caller environment value and supply a finite CLI default.
+ */
+export function configureSyncLockTimeout(raw: string | undefined): void {
+  const value = raw ?? process.env.HQ_OP_LOCK_TIMEOUT ?? String(DEFAULT_SYNC_LOCK_TIMEOUT_SECONDS);
+  const seconds = Number(value);
+  if (!Number.isInteger(seconds) || seconds < 0) {
+    throw new Error("--lock-timeout must be a non-negative integer number of seconds");
+  }
+  process.env.HQ_OP_LOCK_TIMEOUT = String(seconds);
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -821,6 +839,10 @@ export function registerCloudCommands(program: Command): void {
       "--company <slug>",
       "Company slug or UID (defaults to active company in .hq/config.json)",
     )
+    .option(
+      "--lock-timeout <seconds>",
+      "Maximum wait for another active HQ operation (default: 300; 0 = refuse immediately)",
+    )
     .option(
       "--message <msg>",
       "Optional message attached to journal entries for these uploads",
@@ -884,6 +906,7 @@ export function registerCloudCommands(program: Command): void {
         },
       ) => {
         try {
+          configureSyncLockTimeout(options.lockTimeout);
           assertSingleSelector(options, "push");
         } catch (err) {
           console.error(
@@ -1118,6 +1141,10 @@ export function registerCloudCommands(program: Command): void {
       "--company <slug>",
       "Company slug or UID (defaults to active company in .hq/config.json)",
     )
+    .option(
+      "--lock-timeout <seconds>",
+      "Maximum wait for another active HQ operation (default: 300; 0 = refuse immediately)",
+    )
     .option(
       "--on-conflict <strategy>",
       "Conflict strategy: overwrite | keep | abort (omit for interactive)",
@@ -1168,6 +1195,7 @@ export function registerCloudCommands(program: Command): void {
         },
       ) => {
         try {
+          configureSyncLockTimeout(options.lockTimeout);
           assertSingleSelector(options, "pull");
         } catch (err) {
           console.error(
@@ -1410,6 +1438,10 @@ export function registerCloudCommands(program: Command): void {
       "--company <slug>",
       "Company slug or UID (defaults to active company in .hq/config.json)",
     )
+    .option(
+      "--lock-timeout <seconds>",
+      "Maximum wait for another active HQ operation (default: 300; 0 = refuse immediately)",
+    )
     .option(
       "--message <msg>",
       "Optional message attached to journal entries for the push leg",
@@ -1460,6 +1492,7 @@ export function registerCloudCommands(program: Command): void {
         },
       ) => {
         try {
+          configureSyncLockTimeout(options.lockTimeout);
           assertSingleSelector(options, "now");
           if (options.all) {
             // `options.personal === false` is Commander's auto-negation

package/src/commands/company.test.ts

@@ -104,6 +104,31 @@ describe("hq company settings set", () => {
     expect(sent.ontologyEnabled).toBeUndefined();
   });
 
+  it("PUTs accountingEnabled=true with the resolved companyUid", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { companySettings: { accountingEnabled: true } }),
+    );
+
+    await run([
+      "company",
+      "settings",
+      "set",
+      "--company",
+      "acme",
+      "--accounting-enabled",
+      "true",
+    ]);
+
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    const sent = JSON.parse(fetchSpy.mock.calls[0][1]?.body as string);
+    expect(sent).toMatchObject({
+      companyUid: "cmp_acme",
+      accountingEnabled: true,
+    });
+    expect(sent.crmEnabled).toBeUndefined();
+    expect(sent.ontologyEnabled).toBeUndefined();
+  });
+
   it("PUTs both flags when both are supplied", async () => {
     fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
 

package/src/commands/company.ts

@@ -7,8 +7,9 @@ import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
  * `hq company settings set` — owner-only per-company settings toggles
  * (agency group-grants US-007 / hq-native-crm US-003). Wraps
  * `PUT /company-settings`, setting the runtime-flippable `crmEnabled` /
- * `ontologyEnabled` flags so an owner can enable the native CRM (and the
- * ontology gardener) for a company without a redeploy.
+ * `ontologyEnabled` / `accountingEnabled` flags so an owner can enable the
+ * native CRM, ontology gardener, or accounting pack for a company without a
+ * redeploy.
  *
  * Conventions mirror `secrets.ts`: ensureCognitoToken() → getEntityUid() →
  * vaultApiFetch() → error-check → chalk output.
@@ -17,6 +18,7 @@ import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
 interface SettingsSetFlags {
   crmEnabled?: string;
   ontologyEnabled?: string;
+  accountingEnabled?: string;
 }
 
 /**
@@ -45,7 +47,7 @@ export function registerCompanyCommand(program: Command): void {
     .command("set")
     .description(
       "Set per-company settings (PUT /company-settings). Require at least one " +
-        "of --crm-enabled / --ontology-enabled.",
+        "of --crm-enabled / --ontology-enabled / --accounting-enabled.",
     )
     .option(
       "--crm-enabled <true|false>",
@@ -55,6 +57,10 @@ export function registerCompanyCommand(program: Command): void {
       "--ontology-enabled <true|false>",
       "Enable/disable the ontology gardener for this company",
     )
+    .option(
+      "--accounting-enabled <true|false>",
+      "Enable/disable the accounting pack for this company",
+    )
     .action(async (opts: SettingsSetFlags) => {
       try {
         const companySlug = company.opts().company as string | undefined;
@@ -62,10 +68,14 @@ export function registerCompanyCommand(program: Command): void {
           console.error(chalk.red("Error: --company <slug> is required."));
           process.exit(1);
         }
-        if (opts.crmEnabled === undefined && opts.ontologyEnabled === undefined) {
+        if (
+          opts.crmEnabled === undefined &&
+          opts.ontologyEnabled === undefined &&
+          opts.accountingEnabled === undefined
+        ) {
           console.error(
             chalk.red(
-              "Error: provide at least one of --crm-enabled / --ontology-enabled.",
+              "Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled.",
             ),
           );
           process.exit(1);
@@ -81,6 +91,12 @@ export function registerCompanyCommand(program: Command): void {
             "--ontology-enabled",
           );
         }
+        if (opts.accountingEnabled !== undefined) {
+          body.accountingEnabled = parseBoolFlag(
+            opts.accountingEnabled,
+            "--accounting-enabled",
+          );
+        }
 
         const token = await ensureCognitoToken();
         const companyUid = await getEntityUid(token, { companySlug });

package/src/main.ts

@@ -75,6 +75,10 @@ import {
 } from "./utils/version-gate.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { emitCliSessionStarted } from "./utils/cli-telemetry.js";
+import { settleWithin } from "./utils/settle-with-timeout.js";
+
+/** Hard upper bound for non-user-visible release-health finalization. */
+const RELEASE_HEALTH_SETTLE_TIMEOUT_MS = 3_000;
 
 // Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes
 // the pipe early. This covers the ASYNC path — an 'error' event emitted on the
@@ -351,6 +355,13 @@ export async function runCli(): Promise<void> {
   } finally {
     // Release health: finalize the per-run session before the flush.
     Sentry.endSession();
-    await Promise.allSettled([refreshVersionCache(), Sentry.flush(2000)]);
+    // Neither task may turn a successful command into Node's
+    // `unsettled top-level await` exit. They are observability-only after the
+    // command has completed, so a bounded best-effort wait is the terminal
+    // lifecycle boundary for this invocation.
+    await settleWithin(
+      [refreshVersionCache(), Sentry.flush(2000)],
+      RELEASE_HEALTH_SETTLE_TIMEOUT_MS,
+    );
   }
 }

package/src/utils/settle-with-timeout.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { settleWithin } from "./settle-with-timeout.js";
+
+describe("settleWithin", () => {
+  it("settles normally when all finalizers finish", async () => {
+    await expect(settleWithin([Promise.resolve(), Promise.reject(new Error("ignored"))], 100))
+      .resolves.toBe("settled");
+  });
+
+  it("settles the caller when a best-effort finalizer never resolves", async () => {
+    vi.useFakeTimers();
+    try {
+      const result = settleWithin([new Promise<void>(() => {})], 1_000);
+      await vi.advanceTimersByTimeAsync(1_000);
+      await expect(result).resolves.toBe("timed_out");
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});

package/src/utils/settle-with-timeout.ts

@@ -0,0 +1,22 @@
+/**
+ * Await finalization work without allowing a best-effort promise to leave a
+ * CLI's top-level await pending forever. The timer intentionally stays
+ * referenced: Node must remain alive long enough to settle this race.
+ */
+export async function settleWithin(
+  promises: readonly Promise<unknown>[],
+  timeoutMs: number,
+): Promise<"settled" | "timed_out"> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timedOut = new Promise<"timed_out">((resolve) => {
+    timer = setTimeout(() => resolve("timed_out"), timeoutMs);
+  });
+  try {
+    return await Promise.race([
+      Promise.allSettled(promises).then(() => "settled" as const),
+      timedOut,
+    ]);
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+  }
+}

package/src/utils/vault-api.test.ts

@@ -8,6 +8,7 @@ import { Sentry } from '../sentry.js';
 import { getCompanyUid, getEntityUid, resolveCallerPersonUid, vaultApiFetch } from './vault-api.js';
 import { isAuthError } from './auth-error.js';
 import { isCompanySelectionError } from './company-selection-error.js';
+import { isExpectedUserError } from './expected-cli-error.js';
 
 const fetchMock = vi.fn();
 const originalFetch = globalThis.fetch;
@@ -142,6 +143,19 @@ describe('getEntityUid', () => {
     expect(fetchMock.mock.calls[1][0]).toMatch(/\/entity\/by-slug\/company\/acme/);
   });
 
+  it('classifies a global by-slug entity miss as an expected user error (HQ-CLI-8)', async () => {
+    fetchMock
+      .mockResolvedValueOnce(mockResponse(200, { available: true }))
+      .mockResolvedValueOnce(mockResponse(404, { error: 'Entity not found' }));
+
+    const err = await getEntityUid('tok', { companySlug: 'missing-co' }).catch(
+      (e: unknown) => e,
+    );
+
+    expect(isExpectedUserError(err)).toBe(true);
+    expect((err as Error).message).toMatch(/Company slug 'missing-co' was not found/);
+  });
+
   it('on residual global ambiguity (not in namespace) gives actionable --company <uid> guidance', async () => {
     // Caller belongs to no "acme"; the slug matches multiple strangers'
     // companies. The server 409s with the colliding uids and the CLI must tell

package/src/utils/vault-api.ts

@@ -217,6 +217,14 @@ async function resolveCompanyUid(token: string, ref: string): Promise<string> {
           body.uids.map((u) => `  --company ${u}`).join('\n'),
       );
     }
+    if (res.status === 404 && body.error === "Entity not found") {
+      throw Object.assign(
+        new Error(
+          `Company slug '${ref}' was not found. Check the slug or run \`hq companies list\`.`,
+        ),
+        { expected: true as const },
+      );
+    }
     throw new Error(
       `Failed to resolve company slug '${ref}': ${body.error ?? res.statusText}`,
     );