@indigoai-us/hq-cli 5.79.0 → 5.80.0

package/dist/commands/cloud.d.ts

@@ -22,6 +22,11 @@ import { type BannerLevel } from "../lib/narrow-hint-banner.js";
  * succeed when files were dropped" guarantee unit-testable.
  */
 export declare function scopeExcludedWarning(count: number): string | null;
+/**
+ * Optional detail line listing the effective write prefixes when a push
+ * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
+ */
+export declare function scopeExcludedPrefixDetail(prefixSet: readonly string[] | undefined): string | null;
 /**
  * Bound foreground waits for a watcher/manual sync that currently owns the
  * per-root operation lock. The cloud engine reads this environment value on
@@ -159,6 +164,8 @@ export interface ShareCallOptions {
     skipUnchanged?: boolean;
     propagateDeletes?: boolean;
     propagateDeletePolicy?: "owned-only" | "currency-gated" | "all";
+    /** DEV-1768 push parity: filter upload plan to granted ACL prefixes. */
+    prefixSet?: PullScope["prefixSet"];
 }
 export interface ShareCallResult {
     filesUploaded: number;
@@ -172,6 +179,8 @@ export interface ShareCallResult {
 export interface PushAllDeps {
     vaultClient: PullAllVaultClient;
     share: (options: ShareCallOptions) => Promise<ShareCallResult>;
+    /** DEV-1768: resolve membership push scope (same as pull). */
+    resolveScope?: (companyUid: string, slug: string) => Promise<PullScope>;
 }
 export interface PushAllOptions {
     hqRoot: string;

package/dist/commands/cloud.js

@@ -32,6 +32,16 @@ export function scopeExcludedWarning(count) {
         `They were skipped, not synced. Re-run with --json to list them, or ` +
         `ask an admin to grant you write on those paths.`);
 }
+/**
+ * Optional detail line listing the effective write prefixes when a push
+ * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
+ */
+export function scopeExcludedPrefixDetail(prefixSet) {
+    if (!prefixSet || prefixSet.length === 0) {
+        return "  Granted write prefixes: (none — shared-mode membership with no explicit grants)";
+    }
+    return `  Granted write prefixes: ${prefixSet.join(", ")}`;
+}
 /**
  * Resolve the `propagateDeletePolicy` for share() calls.
  *
@@ -268,6 +278,7 @@ export async function pushAll(options, deps) {
         }
         plan.push({
             slug,
+            companyUid: m.companyUid,
             shareOptions: {
                 company: m.companyUid,
                 hqRoot: options.hqRoot,
@@ -284,6 +295,7 @@ export async function pushAll(options, deps) {
     if (personal) {
         plan.push({
             slug: "personal",
+            companyUid: personal.uid,
             shareOptions: {
                 company: personal.uid,
                 hqRoot: options.hqRoot,
@@ -309,6 +321,17 @@ export async function pushAll(options, deps) {
     };
     for (const entry of plan) {
         result.attempted += 1;
+        if (entry.slug !== "personal" && deps.resolveScope) {
+            try {
+                const scope = await deps.resolveScope(entry.companyUid, entry.slug);
+                if (scope.prefixSet !== undefined) {
+                    entry.shareOptions.prefixSet = scope.prefixSet;
+                }
+            }
+            catch {
+                // Degrade to no explicit scope filter — share() treats undefined as full access.
+            }
+        }
         try {
             const r = await deps.share(entry.shareOptions);
             result.filesUploaded += r.filesUploaded;
@@ -582,6 +605,8 @@ export function registerCloudCommands(program) {
             //   2. default: vend via cached Cognito session (the human CLI path).
             let entityContext;
             let vaultConfig;
+            /** Vault API config for membership/grant scope lookups. Set even on the pre-vended `--creds-from-stdin` path — share() accepts entityContext OR vaultConfig, not both. */
+            let scopeVaultConfig;
             if (options.credsFromStdin) {
                 if (process.stdin.isTTY) {
                     throw new Error("--creds-from-stdin requires JSON on stdin, but stdin is a " +
@@ -595,17 +620,22 @@ export function registerCloudCommands(program) {
                 catch (e) {
                     throw new Error(`--creds-from-stdin: failed to parse stdin as JSON: ${e instanceof Error ? e.message : String(e)}`);
                 }
+                // Upload creds are pre-vended in entityContext, but prefix filtering
+                // still needs vault-service membership/grant resolution.
+                const accessToken = await ensureCognitoToken();
+                scopeVaultConfig = buildVaultConfig(accessToken);
             }
             else {
                 const accessToken = await ensureCognitoToken();
                 vaultConfig = buildVaultConfig(accessToken);
+                scopeVaultConfig = vaultConfig;
             }
             // Resolve the target. For `--personal`, look up the caller's
             // canonical person entity and force personalMode + journalSlug so
             // share() lands files at hqRoot directly (no companies/<slug>/
             // prefix). For everything else, the company is whatever the user
             // passed or the active company from .hq/config.json.
-            let targetCompany = options.company;
+            let targetCompany = options.company ?? entityContext?.uid;
             let personalMode = false;
             let journalSlug;
             if (options.personal) {
@@ -646,6 +676,12 @@ export function registerCloudCommands(program) {
             // idToken — pre-vended `--creds-from-stdin` paths still get author
             // attribution as long as the caller is logged in locally.
             const author = resolveUploadAuthorFromCache();
+            let pushPrefixSet;
+            if (!personalMode && scopeVaultConfig) {
+                const scopeClient = new VaultClient(scopeVaultConfig);
+                const scope = await resolveCliPullScope(scopeClient, targetCompany, options.hqRoot);
+                pushPrefixSet = scope?.prefixSet;
+            }
             const result = await share({
                 paths: targetPaths,
                 company: targetCompany,
@@ -658,6 +694,7 @@ export function registerCloudCommands(program) {
                 ...(personalMode ? { personalMode: true } : {}),
                 ...(journalSlug !== undefined ? { journalSlug } : {}),
                 ...(author ? { author } : {}),
+                ...(pushPrefixSet !== undefined ? { prefixSet: pushPrefixSet } : {}),
             });
             if (jsonMode) {
                 // Synthetic terminal event so subprocess consumers can read final
@@ -681,6 +718,9 @@ export function registerCloudCommands(program) {
                 log(chalk.yellow(`\n⚠ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ` +
                     `${result.filesSkipped} skipped, ${result.filesExcludedByScope} scope-excluded)`));
                 log(chalk.yellow(scopeExcludedWarning(result.filesExcludedByScope)));
+                const prefixDetail = scopeExcludedPrefixDetail(pushPrefixSet);
+                if (prefixDetail)
+                    log(chalk.yellow(prefixDetail));
             }
             else {
                 log(chalk.green(`\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`));
@@ -1091,6 +1131,7 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
             ...(skipPersonal ? { skipPersonal: true } : {}),
         }, {
             vaultClient: adapter,
+            resolveScope: (companyUid, slug) => resolvePullScope(realClient, companyUid, slug, hqRoot),
             share: (opts) => share({
                 paths: opts.paths,
                 company: opts.company,
@@ -1113,6 +1154,7 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
                 ...(opts.propagateDeletePolicy !== undefined
                     ? { propagateDeletePolicy: opts.propagateDeletePolicy }
                     : {}),
+                ...(opts.prefixSet !== undefined ? { prefixSet: opts.prefixSet } : {}),
                 ...(author ? { author } : {}),
             }),
         });
@@ -1195,6 +1237,12 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
         // Push first so the subsequent pull doesn't redownload files we were
         // about to broadcast (matches hq-sync-runner ordering).
         console.log(chalk.dim("  → push leg"));
+        let nowPushPrefixSet;
+        if (!personalMode) {
+            const scopeClient = new VaultClient(vaultConfig);
+            const pushScope = await resolveCliPullScope(scopeClient, targetCompany, hqRoot);
+            nowPushPrefixSet = pushScope?.prefixSet;
+        }
         const pushResult = await share({
             paths: pushPaths,
             company: targetCompany,
@@ -1208,6 +1256,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             ...(personalMode ? { personalMode: true } : {}),
             ...(journalSlug !== undefined ? { journalSlug } : {}),
             ...(author ? { author } : {}),
+            ...(nowPushPrefixSet !== undefined ? { prefixSet: nowPushPrefixSet } : {}),
         });
         const pushStatus = pushResult.aborted || pushResult.filesExcludedByScope > 0
             ? chalk.yellow("⚠")
@@ -1218,6 +1267,9 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             (pushResult.aborted ? " — aborted" : ""));
         if (pushResult.filesExcludedByScope > 0) {
             console.log(chalk.yellow(scopeExcludedWarning(pushResult.filesExcludedByScope)));
+            const prefixDetail = scopeExcludedPrefixDetail(nowPushPrefixSet);
+            if (prefixDetail)
+                console.log(chalk.yellow(prefixDetail));
         }
         if (pushResult.aborted) {
             console.log(chalk.yellow("\n⚠ Sync now aborted on push leg; pull skipped."));

package/dist/commands/packs.js

@@ -78,7 +78,7 @@ export function buildInstalledView(hqRoot, hqVersion, pack, installedSources, ch
     const counts = { live: 0, broken: 0, missing: 0, foreign: 0 };
     const brokenLinks = [];
     for (const link of links) {
-        const st = linkStatus(link);
+        const st = linkStatus(link, pack.dir);
         counts[st]++;
         if (st === 'broken')
             brokenLinks.push({ key: link.key, item: link.item, dst: link.dst });

package/dist/index.js

@@ -11,8 +11,12 @@ if (isVersionRequest(process.argv)) {
     process.stdout.write(`${CLI_VERSION}\n`);
 }
 else {
-    const { runCli } = await import("./main.js");
-    await runCli();
+    // Keep the command lifecycle detached from module evaluation, as it was
+    // before the fast --version split. Some best-effort teardown work uses
+    // unref'd handles; top-level-awaiting runCli() makes Node turn an otherwise
+    // successful command into exit 13 when that teardown promise remains pending.
+    // Rejections still become unhandled and preserve a genuine non-zero failure.
+    void import("./main.js").then(({ runCli }) => runCli());
 }
 export const __test__ = { isVersionRequest };
 //# sourceMappingURL=index.js.map

package/dist/utils/pack-contributions.d.ts

@@ -75,8 +75,13 @@ export type LinkStatus = 'live' | 'broken' | 'missing' | 'foreign';
  * effect (a config merge) is handled separately (US-004/US-005).
  */
 export declare function contributionLinks(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): WiredLink[];
+/**
+ * Canonical absolute path — resolves symlinks and platform aliases such as
+ * macOS `/var` ↔ `/private/var` so equivalent paths compare equal.
+ */
+export declare function canonicalPath(p: string): string;
 /** Classify a host path against the link that should own it. */
-export declare function linkStatus(link: WiredLink): LinkStatus;
+export declare function linkStatus(link: WiredLink, packDir?: string): LinkStatus;
 /** A content pack's manifest plus the install-time stamped source. */
 export interface InstalledPackManifest extends PackManifest {
     source?: string;

package/dist/utils/pack-contributions.js

@@ -132,8 +132,42 @@ export function contributionLinks(hqRoot, packDir, contributes) {
     }
     return links;
 }
+/**
+ * Canonical absolute path — resolves symlinks and platform aliases such as
+ * macOS `/var` ↔ `/private/var` so equivalent paths compare equal.
+ */
+export function canonicalPath(p) {
+    try {
+        return fs.realpathSync.native(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+/** True when `candidate` resolves under `packDir` (pack directory containment). */
+function targetUnderPackDir(packDir, candidate) {
+    const root = canonicalPath(packDir);
+    const resolved = canonicalPath(candidate);
+    const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+    return resolved === root || resolved.startsWith(prefix);
+}
+/** True when `a` and `b` resolve to the same on-disk file (canonical path or inode). */
+function samePayloadFile(a, b) {
+    const canonA = canonicalPath(a);
+    const canonB = canonicalPath(b);
+    if (canonA === canonB)
+        return true;
+    try {
+        const stA = fs.statSync(a);
+        const stB = fs.statSync(b);
+        return stA.dev === stB.dev && stA.ino === stB.ino;
+    }
+    catch {
+        return false;
+    }
+}
 /** Classify a host path against the link that should own it. */
-export function linkStatus(link) {
+export function linkStatus(link, packDir) {
     let st;
     try {
         st = fs.lstatSync(link.dst);
@@ -151,13 +185,21 @@ export function linkStatus(link) {
     catch {
         return 'foreign';
     }
-    // scan-packages.sh writes the symlink target as the absolute `src` path, so a
-    // direct compare is correct. Resolve both to be robust to trailing slashes.
+    // scan-packages.sh writes the symlink target as the absolute `src` path.
+    // Canonicalize both sides so `/var` vs `/private/var` (macOS) and symlink
+    // aliases classify as ours; optionally accept stale targets that still resolve
+    // inside this pack's directory.
     const resolvedTarget = path.resolve(path.dirname(link.dst), target);
-    if (path.resolve(link.src) !== resolvedTarget) {
-        return 'foreign'; // points at another pack / somewhere else
+    if (samePayloadFile(link.src, resolvedTarget)) {
+        return fs.existsSync(link.src) ? 'live' : 'broken';
+    }
+    if (packDir !== undefined && targetUnderPackDir(packDir, resolvedTarget)) {
+        // Stale or corrupted: symlink resolves inside this pack but not to the
+        // declared payload. Treat as broken (never live) so list does not report a
+        // healthy link; unwirePack still removes it on uninstall.
+        return 'broken';
     }
-    return fs.existsSync(link.src) ? 'live' : 'broken';
+    return 'foreign'; // points at another pack / somewhere else
 }
 /** Absolute path to `<hqRoot>/core/packages`. */
 export function packagesDir(hqRoot) {
@@ -230,7 +272,7 @@ export function findDependentPacks(installed, name) {
 export function unwirePack(hqRoot, packDir, contributes) {
     const result = { unlinked: [], skipped: [] };
     for (const link of contributionLinks(hqRoot, packDir, contributes)) {
-        const status = linkStatus(link);
+        const status = linkStatus(link, packDir);
         if (status === 'live' || status === 'broken') {
             try {
                 fs.unlinkSync(link.dst);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.79.0",
+  "version": "5.80.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -29,7 +29,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "^6.14.27",
+    "@indigoai-us/hq-cloud": "^6.14.37",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "better-sqlite3": "^12.11.1",