@indigoai-us/hq-cli 5.77.9 → 5.77.11

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [5.77.11]
+
+### Fixed
+
+- `hq members promote <email>` now looks up the active member roster by
+  `personEmail` (and maps fleet-agent machine emails like revoke) instead of
+  synthesizing a pending-only `email:…#cmp` membership key that the role API
+  cannot find. (#269)
+- Re-inviting an email that already has a pending invite no longer claims the
+  person is already a member; the CLI distinguishes pending vs active and
+  suggests `hq members invite <email> --company <slug> --resend` when
+  appropriate. (#269)
+
+## [5.77.10]
+
+### Fixed
+
+- Updated `@indigoai-us/hq-cloud` to 6.14.27 so the sync watcher no longer
+  descends into directory-only ignores such as nested `node_modules/`, which
+  could exhaust host inotify watches. (#268)
+
 ## [5.77.9]
 
 ### Added

package/dist/commands/members.d.ts

@@ -142,6 +142,14 @@ export declare class InviteHttpError extends Error {
 export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
 export declare function listActiveMembers(token: string, companyUid: string): Promise<ActiveMember[]>;
+/**
+ * Resolve a role-change target to an active membership key.
+ *
+ * Pending invites are email-keyed, but claimed active memberships are keyed by
+ * personUid. Consequently, role changes must look up email targets in the
+ * active member list instead of synthesizing an `email:...#company` key.
+ */
+export declare function resolveRoleChangeTarget(token: string, companyUid: string, target: string): Promise<string>;
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:

package/dist/commands/members.js

@@ -244,6 +244,39 @@ export async function listActiveMembers(token, companyUid) {
     const data = (await res.json());
     return data?.members ?? [];
 }
+/**
+ * Resolve a role-change target to an active membership key.
+ *
+ * Pending invites are email-keyed, but claimed active memberships are keyed by
+ * personUid. Consequently, role changes must look up email targets in the
+ * active member list instead of synthesizing an `email:...#company` key.
+ */
+export async function resolveRoleChangeTarget(token, companyUid, target) {
+    if (target.includes("#"))
+        return target;
+    const detected = detectTarget(target);
+    if (detected?.type === "person" || detected?.type === "agent") {
+        return `${detected.value}#${companyUid}`;
+    }
+    if (detected?.type === "email") {
+        // Active fleet-agent guest memberships are keyed agt_…#cmp_…, not by
+        // personEmail enrichment. Map machine emails the same way revoke does
+        // before falling through to the human roster lookup.
+        if (detected.isAgent) {
+            const local = detected.value.split("@")[0] ?? "";
+            const m = local.match(/^agt-(.+)$/i);
+            if (m)
+                return `agt_${m[1].toUpperCase()}#${companyUid}`;
+        }
+        const members = await listActiveMembers(token, companyUid);
+        const member = members.find((candidate) => candidate.personEmail?.trim().toLowerCase() === detected.value);
+        if (member)
+            return member.membershipKey;
+        throw new Error(`No active member has email '${detected.value}' in this company. ` +
+            "Run `hq members list` to find the member, or use their prs_ personUid.");
+    }
+    throw new Error(`Invalid target '${target}': use an email, prs_ personUid, agt_ agentUid, or full membership key`);
+}
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:
@@ -356,7 +389,7 @@ export function registerMembersCommand(program) {
             const token = await ensureCognitoToken();
             const companySlug = members.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            const membershipKey = resolveRevokeTargetToMembershipKey(target, companyUid);
+            const membershipKey = await resolveRoleChangeTarget(token, companyUid, target);
             await changeMemberRole(token, companyUid, membershipKey, role);
             console.log(chalk.green(`Updated role for '${target}' to ${role}`));
             if (role === "owner" || role === "admin") {
@@ -388,10 +421,13 @@ export function registerMembersCommand(program) {
         .option("--no-send-email", "Skip the server-side Resend send — only create the pending DDB row. Useful when you're scripting bulk invites and will send the announcement out-of-band.")
         .option("--resend", "Re-fire the invitation email against an existing pending row without creating a new row. Maps to hq-pro `resend: true` short-circuit. Email-keyed invites only.")
         .action(async (target, opts) => {
+        let token;
+        let companyUid;
+        let companySlug;
         try {
-            const token = await ensureCognitoToken();
-            const companySlug = members.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            token = await ensureCognitoToken();
+            companySlug = members.opts().company;
+            companyUid = await getCompanyUid(token, companySlug);
             const callerUid = await getCallerPersonUid(token);
             // --resend short-circuits to the server's re-fire path. No new row.
             if (opts.resend === true) {
@@ -511,13 +547,50 @@ export function registerMembersCommand(program) {
             }
         }
         catch (err) {
-            // The target is ALREADY an active member (409 MEMBERSHIP_ALREADY_EXISTS).
-            // Terminal, not a failure: the person is already in the company, so
-            // there's nothing to invite or retry. Print a plain note and exit 0 —
-            // re-attempting just re-fires the server's (correctly captured) 409,
-            // and a bulk-invite script shouldn't abort on an already-member. HQ-11.
+            // A 409 may refer to either an active membership or an existing
+            // pending invite. Probe both views so email targets get actionable
+            // guidance while preserving the terminal exit-0 behavior for bulk
+            // invite scripts.
             if (err instanceof InviteHttpError &&
                 err.code === "MEMBERSHIP_ALREADY_EXISTS") {
+                const detected = detectTarget(target);
+                const normalizedEmail = detected?.type === "email" ? detected.value : undefined;
+                if (normalizedEmail && token && companyUid) {
+                    // Preserve --company in copy-paste hints so multi-company
+                    // callers don't hit "Multiple active companies" on --resend.
+                    const companyFlag = companySlug
+                        ? ` --company ${companySlug}`
+                        : "";
+                    const resendHint = `hq members invite ${normalizedEmail}${companyFlag} --resend`;
+                    try {
+                        const pending = await listPendingInvites(token, companyUid);
+                        if (pending.some((invite) => invite.inviteeEmail?.trim().toLowerCase() ===
+                            normalizedEmail)) {
+                            console.log(chalk.yellow(`${normalizedEmail} already has a pending invite. ` +
+                                `Use \`${resendHint}\` to re-send it.`));
+                            return;
+                        }
+                    }
+                    catch {
+                        // Pending-list visibility can vary by server version or role.
+                        // Fall through to the active-member probe and generic copy.
+                    }
+                    try {
+                        const activeMembers = await listActiveMembers(token, companyUid);
+                        if (activeMembers.some((member) => member.personEmail?.trim().toLowerCase() ===
+                            normalizedEmail)) {
+                            console.log(chalk.yellow(`${normalizedEmail} is already a member of this company — nothing to do.`));
+                            return;
+                        }
+                    }
+                    catch {
+                        // Preserve the original conflict as the source of truth and
+                        // use copy that remains accurate when the probes are hidden.
+                    }
+                    console.log(chalk.yellow(`${normalizedEmail} already has a membership or pending invite for this company. ` +
+                        `If the invite is pending, use \`${resendHint}\`.`));
+                    return;
+                }
                 console.log(chalk.yellow(`${target.toLowerCase()} is already a member of this company — nothing to do.`));
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.77.9",
+  "version": "5.77.11",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "^6.14.19",
+    "@indigoai-us/hq-cloud": "^6.14.27",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "better-sqlite3": "^12.11.1",

package/pnpm-workspace.yaml

@@ -1,4 +1,4 @@
 allowBuilds:
   better-sqlite3: true
 minimumReleaseAgeExclude:
-  - '@indigoai-us/hq-cloud@6.14.14 || 6.14.18 || 6.14.19'
+  - '@indigoai-us/hq-cloud@6.14.14 || 6.14.18 || 6.14.19 || 6.14.27'

package/src/commands/members.test.ts

@@ -43,6 +43,7 @@ import {
   listPendingInvites,
   registerMembersCommand,
   resendInvite,
+  resolveRoleChangeTarget,
   resolveRevokeTargetToMembershipKey,
   revokeInvite,
 } from "./members.js";
@@ -1092,7 +1093,22 @@ describe("changeMemberRole", () => {
 
 describe("registerMembersCommand promote", () => {
   it("resolves an email target and promotes to a full-set role the old set-role couldn't (admin)", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+    fetchSpy
+      .mockResolvedValueOnce(
+        jsonResponse(200, {
+          members: [
+            {
+              membershipKey: "prs_alice#cmp_acme",
+              personUid: "prs_alice",
+              companyUid: "cmp_acme",
+              role: "member",
+              status: "active",
+              personEmail: "Alice@Example.com",
+            },
+          ],
+        }),
+      )
+      .mockResolvedValueOnce(jsonResponse(200, {}));
     const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
 
     await buildMembersProgram().parseAsync(
@@ -1100,14 +1116,18 @@ describe("registerMembersCommand promote", () => {
       { from: "user" },
     );
 
-    const call = fetchSpy.mock.calls[0];
+    expect(String(fetchSpy.mock.calls[0][0])).toMatch(
+      /\/membership\/company\/cmp_acme$/,
+    );
+    const call = fetchSpy.mock.calls[1];
     expect(String(call[0])).toMatch(/\/membership\/role$/);
     const body = JSON.parse((call[1]?.body as string) ?? "{}");
     expect(body).toEqual({
       companyUid: "cmp_acme",
-      membershipKey: "email:alice@example.com#cmp_acme",
+      membershipKey: "prs_alice#cmp_acme",
       newRole: "admin",
     });
+    expect(body.membershipKey).not.toContain("email:");
     expect(logSpy).toHaveBeenCalledWith(
       expect.stringContaining("Updated role for 'alice@example.com' to admin"),
     );
@@ -1123,6 +1143,43 @@ describe("registerMembersCommand promote", () => {
     );
   });
 
+  it("fails clearly when no active member matches an email and never posts a role change", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { members: [] }));
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+    vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+      throw new Error(`__EXIT__:${code ?? 0}`);
+    }) as never);
+
+    await expect(
+      buildMembersProgram().parseAsync(
+        [
+          "members",
+          "--company",
+          "acme",
+          "promote",
+          "missing@example.com",
+          "admin",
+        ],
+        { from: "user" },
+      ),
+    ).rejects.toThrow("__EXIT__:1");
+
+    const errorOutput = errSpy.mock.calls
+      .flatMap((call) => call.map(String))
+      .join(" ");
+    expect(errorOutput).toContain(
+      "No active member has email 'missing@example.com'",
+    );
+    expect(errorOutput).toContain("hq members list");
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    expect(
+      fetchSpy.mock.calls.some(
+        ([url, init]) =>
+          String(url).endsWith("/membership/role") && init?.method === "POST",
+      ),
+    ).toBe(false);
+  });
+
   it("forwards a personUid target and the guest role (beyond set-role's admin|member cap)", async () => {
     fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
     const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
@@ -1189,6 +1246,141 @@ describe("registerMembersCommand promote", () => {
   });
 });
 
+describe("resolveRoleChangeTarget", () => {
+  it("passes through a full membership key without fetching members", async () => {
+    await expect(
+      resolveRoleChangeTarget(
+        "test-token",
+        "cmp_acme",
+        "prs_alice#cmp_acme",
+      ),
+    ).resolves.toBe("prs_alice#cmp_acme");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("wraps bare person and agent uids without fetching members", async () => {
+    await expect(
+      resolveRoleChangeTarget("test-token", "cmp_acme", "prs_alice"),
+    ).resolves.toBe("prs_alice#cmp_acme");
+    await expect(
+      resolveRoleChangeTarget("test-token", "cmp_acme", "agt_ops"),
+    ).resolves.toBe("agt_ops#cmp_acme");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("maps agent machine emails to agt_…#companyUid without fetching members", async () => {
+    await expect(
+      resolveRoleChangeTarget(
+        "test-token",
+        "cmp_acme",
+        "agt-01hxyzabcdefghjkmnpqrstvwx@agents.getindigo.ai",
+      ),
+    ).resolves.toBe("agt_01HXYZABCDEFGHJKMNPQRSTVWX#cmp_acme");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// registerMembersCommand invite — MEMBERSHIP_ALREADY_EXISTS messaging
+// ---------------------------------------------------------------------------
+
+describe("registerMembersCommand invite 409 messaging", () => {
+  function mockCallerIdentity(): void {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        memberships: [
+          {
+            membershipKey: "prs_admin#cmp_acme",
+            personUid: "prs_admin",
+            companyUid: "cmp_acme",
+            role: "owner",
+            status: "active",
+          },
+        ],
+      }),
+    );
+  }
+
+  it("guides --resend when the conflict is a pending invite", async () => {
+    mockCallerIdentity();
+    fetchSpy
+      .mockResolvedValueOnce(
+        jsonResponse(409, {
+          error: "Membership already exists",
+          code: "MEMBERSHIP_ALREADY_EXISTS",
+        }),
+      )
+      .mockResolvedValueOnce(
+        jsonResponse(200, {
+          pending: [
+            {
+              membershipKey: "email:alice@example.com#cmp_acme",
+              inviteeEmail: "alice@example.com",
+              companyUid: "cmp_acme",
+              role: "member",
+              status: "pending",
+              invitedBy: "prs_admin",
+              invitedAt: "2026-05-21T12:00:00Z",
+            },
+          ],
+        }),
+      );
+
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "invite", "Alice@Example.com"],
+      { from: "user" },
+    );
+
+    const output = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(output).toContain("already has a pending invite");
+    expect(output).toContain(
+      "hq members invite alice@example.com --company acme --resend",
+    );
+    expect(output).not.toContain("already a member of this company");
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("keeps the already-member note when the conflict is an active member", async () => {
+    mockCallerIdentity();
+    fetchSpy
+      .mockResolvedValueOnce(
+        jsonResponse(409, {
+          error: "Membership already exists",
+          code: "MEMBERSHIP_ALREADY_EXISTS",
+        }),
+      )
+      .mockResolvedValueOnce(jsonResponse(200, { pending: [] }))
+      .mockResolvedValueOnce(
+        jsonResponse(200, {
+          members: [
+            {
+              membershipKey: "prs_alice#cmp_acme",
+              personUid: "prs_alice",
+              companyUid: "cmp_acme",
+              role: "member",
+              status: "active",
+              personEmail: "alice@example.com",
+            },
+          ],
+        }),
+      );
+
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "invite", "alice@example.com"],
+      { from: "user" },
+    );
+
+    const output = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(output).toContain("already a member of this company");
+    expect(output).not.toContain("pending invite");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // resolveRevokeTargetToMembershipKey
 // ---------------------------------------------------------------------------

package/src/commands/members.ts

@@ -471,6 +471,52 @@ export async function listActiveMembers(
   return data?.members ?? [];
 }
 
+/**
+ * Resolve a role-change target to an active membership key.
+ *
+ * Pending invites are email-keyed, but claimed active memberships are keyed by
+ * personUid. Consequently, role changes must look up email targets in the
+ * active member list instead of synthesizing an `email:...#company` key.
+ */
+export async function resolveRoleChangeTarget(
+  token: string,
+  companyUid: string,
+  target: string,
+): Promise<string> {
+  if (target.includes("#")) return target;
+
+  const detected = detectTarget(target);
+  if (detected?.type === "person" || detected?.type === "agent") {
+    return `${detected.value}#${companyUid}`;
+  }
+  if (detected?.type === "email") {
+    // Active fleet-agent guest memberships are keyed agt_…#cmp_…, not by
+    // personEmail enrichment. Map machine emails the same way revoke does
+    // before falling through to the human roster lookup.
+    if (detected.isAgent) {
+      const local = detected.value.split("@")[0] ?? "";
+      const m = local.match(/^agt-(.+)$/i);
+      if (m) return `agt_${m[1].toUpperCase()}#${companyUid}`;
+    }
+
+    const members = await listActiveMembers(token, companyUid);
+    const member = members.find(
+      (candidate) =>
+        candidate.personEmail?.trim().toLowerCase() === detected.value,
+    );
+    if (member) return member.membershipKey;
+
+    throw new Error(
+      `No active member has email '${detected.value}' in this company. ` +
+        "Run `hq members list` to find the member, or use their prs_ personUid.",
+    );
+  }
+
+  throw new Error(
+    `Invalid target '${target}': use an email, prs_ personUid, agt_ agentUid, or full membership key`,
+  );
+}
+
 /**
  * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
  * the server requires. Accepts three input forms:
@@ -631,9 +677,10 @@ export function registerMembersCommand(program: Command): void {
         const token = await ensureCognitoToken();
         const companySlug = members.opts().company as string | undefined;
         const companyUid = await getCompanyUid(token, companySlug);
-        const membershipKey = resolveRevokeTargetToMembershipKey(
-          target,
+        const membershipKey = await resolveRoleChangeTarget(
+          token,
           companyUid,
+          target,
         );
 
         await changeMemberRole(token, companyUid, membershipKey, role as Role);
@@ -708,10 +755,13 @@ export function registerMembersCommand(program: Command): void {
           resend?: boolean;
         },
       ) => {
+        let token: string | undefined;
+        let companyUid: string | undefined;
+        let companySlug: string | undefined;
         try {
-          const token = await ensureCognitoToken();
-          const companySlug = members.opts().company as string | undefined;
-          const companyUid = await getCompanyUid(token, companySlug);
+          token = await ensureCognitoToken();
+          companySlug = members.opts().company as string | undefined;
+          companyUid = await getCompanyUid(token, companySlug);
           const callerUid = await getCallerPersonUid(token);
 
           // --resend short-circuits to the server's re-fire path. No new row.
@@ -887,15 +937,79 @@ export function registerMembersCommand(program: Command): void {
             );
           }
         } catch (err) {
-          // The target is ALREADY an active member (409 MEMBERSHIP_ALREADY_EXISTS).
-          // Terminal, not a failure: the person is already in the company, so
-          // there's nothing to invite or retry. Print a plain note and exit 0 —
-          // re-attempting just re-fires the server's (correctly captured) 409,
-          // and a bulk-invite script shouldn't abort on an already-member. HQ-11.
+          // A 409 may refer to either an active membership or an existing
+          // pending invite. Probe both views so email targets get actionable
+          // guidance while preserving the terminal exit-0 behavior for bulk
+          // invite scripts.
           if (
             err instanceof InviteHttpError &&
             err.code === "MEMBERSHIP_ALREADY_EXISTS"
           ) {
+            const detected = detectTarget(target);
+            const normalizedEmail =
+              detected?.type === "email" ? detected.value : undefined;
+
+            if (normalizedEmail && token && companyUid) {
+              // Preserve --company in copy-paste hints so multi-company
+              // callers don't hit "Multiple active companies" on --resend.
+              const companyFlag = companySlug
+                ? ` --company ${companySlug}`
+                : "";
+              const resendHint =
+                `hq members invite ${normalizedEmail}${companyFlag} --resend`;
+
+              try {
+                const pending = await listPendingInvites(token, companyUid);
+                if (
+                  pending.some(
+                    (invite) =>
+                      invite.inviteeEmail?.trim().toLowerCase() ===
+                      normalizedEmail,
+                  )
+                ) {
+                  console.log(
+                    chalk.yellow(
+                      `${normalizedEmail} already has a pending invite. ` +
+                        `Use \`${resendHint}\` to re-send it.`,
+                    ),
+                  );
+                  return;
+                }
+              } catch {
+                // Pending-list visibility can vary by server version or role.
+                // Fall through to the active-member probe and generic copy.
+              }
+
+              try {
+                const activeMembers = await listActiveMembers(token, companyUid);
+                if (
+                  activeMembers.some(
+                    (member) =>
+                      member.personEmail?.trim().toLowerCase() ===
+                      normalizedEmail,
+                  )
+                ) {
+                  console.log(
+                    chalk.yellow(
+                      `${normalizedEmail} is already a member of this company — nothing to do.`,
+                    ),
+                  );
+                  return;
+                }
+              } catch {
+                // Preserve the original conflict as the source of truth and
+                // use copy that remains accurate when the probes are hidden.
+              }
+
+              console.log(
+                chalk.yellow(
+                  `${normalizedEmail} already has a membership or pending invite for this company. ` +
+                    `If the invite is pending, use \`${resendHint}\`.`,
+                ),
+              );
+              return;
+            }
+
             console.log(
               chalk.yellow(
                 `${target.toLowerCase()} is already a member of this company — nothing to do.`,