@indigoai-us/hq-cli 5.97.2 → 5.97.3-rc.1

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [5.97.3-rc.1] — 2026-08-10
+
 ## [5.97.2]
 
 ### Fixed

package/dist/commands/agents.d.ts

@@ -27,6 +27,44 @@ import { type BillingErrorPayload } from "../utils/billing-gate.js";
 export declare const VALID_EFFORTS: Set<string>;
 /** Service-tier (speed) values hq-pro accepts on `runtime-config`. */
 export declare const VALID_TIERS: Set<string>;
+/** Agent runtimes hq-pro accepts on `POST /v1/agents` (`AgentProvider`). */
+export declare const VALID_PROVIDERS: Set<string>;
+/** Auth modes hq-pro accepts on `POST /v1/agents` (`CodexAuthMode`). */
+export declare const VALID_AUTH_MODES: Set<string>;
+/**
+ * Resolve a closed-set option value, or exit(1) with a message naming the
+ * offending input and the legal set.
+ *
+ * WHY THIS EXISTS. `--effort` and `--tier` were already validated this way, but
+ * `--provider` and `--auth-mode` were resolved with a ternary that FELL BACK to
+ * the default on anything unrecognised:
+ *
+ *     opts.provider === "grok" ? "grok" : opts.provider ? "codex" : undefined
+ *     opts.authMode === "apiKey" ? "apiKey" : "subscription"
+ *
+ * So `--provider claude` (before claude was supported) silently provisioned a
+ * CODEX box, and `--auth-mode typo` silently provisioned in SUBSCRIPTION mode.
+ * Both paths are behind a `--yes` charge gate, so the operator paid $100/month
+ * for a runtime they did not ask for, with nothing in the output to say a
+ * substitution had happened. A wrong flag must fail loudly, never resolve to a
+ * plausible default.
+ *
+ * `undefined` in ⇒ `undefined` out: an OMITTED option is not an invalid one, and
+ * keeps the server-side default authoritative.
+ *
+ * Matching is trim + lowercase to be forgiving of shell padding and casing,
+ * EXCEPT that the returned value is the canonical member of the set — so the
+ * wire value is always exactly what hq-pro's validators expect. Note `apiKey`
+ * is camelCase on the wire, so the comparison set is keyed on the lowercased
+ * form and mapped back (see {@link canonicalizeOptionValue}).
+ */
+export declare function parseEnumOption(raw: string | undefined, allowed: Set<string>, flagName: string): string | undefined;
+/**
+ * Case-insensitively map `raw` onto its canonical member of `allowed`, or
+ * `undefined` when it is not a member. Split out from {@link parseEnumOption}
+ * so the mapping is unit-testable without a process exit.
+ */
+export declare function canonicalizeOptionValue(raw: string, allowed: Set<string>): string | undefined;
 /**
  * A non-2xx from the `/v1/agents` control plane. Carries the HTTP status and
  * the registry error `code` (when present) so callers can branch — notably a
@@ -89,7 +127,7 @@ export interface ProvisionAgentInput {
     name: string;
     slug: string;
     codexAuthMode: "subscription" | "apiKey";
-    provider?: "codex" | "grok";
+    provider?: "codex" | "grok" | "claude";
     codexApiKey?: string;
     idempotencyKey: string;
     title?: string;

package/dist/commands/agents.js

@@ -37,6 +37,61 @@ export const VALID_EFFORTS = new Set([
 ]);
 /** Service-tier (speed) values hq-pro accepts on `runtime-config`. */
 export const VALID_TIERS = new Set(["default", "priority"]);
+/** Agent runtimes hq-pro accepts on `POST /v1/agents` (`AgentProvider`). */
+export const VALID_PROVIDERS = new Set(["codex", "grok", "claude"]);
+/** Auth modes hq-pro accepts on `POST /v1/agents` (`CodexAuthMode`). */
+export const VALID_AUTH_MODES = new Set(["subscription", "apiKey"]);
+/**
+ * Resolve a closed-set option value, or exit(1) with a message naming the
+ * offending input and the legal set.
+ *
+ * WHY THIS EXISTS. `--effort` and `--tier` were already validated this way, but
+ * `--provider` and `--auth-mode` were resolved with a ternary that FELL BACK to
+ * the default on anything unrecognised:
+ *
+ *     opts.provider === "grok" ? "grok" : opts.provider ? "codex" : undefined
+ *     opts.authMode === "apiKey" ? "apiKey" : "subscription"
+ *
+ * So `--provider claude` (before claude was supported) silently provisioned a
+ * CODEX box, and `--auth-mode typo` silently provisioned in SUBSCRIPTION mode.
+ * Both paths are behind a `--yes` charge gate, so the operator paid $100/month
+ * for a runtime they did not ask for, with nothing in the output to say a
+ * substitution had happened. A wrong flag must fail loudly, never resolve to a
+ * plausible default.
+ *
+ * `undefined` in ⇒ `undefined` out: an OMITTED option is not an invalid one, and
+ * keeps the server-side default authoritative.
+ *
+ * Matching is trim + lowercase to be forgiving of shell padding and casing,
+ * EXCEPT that the returned value is the canonical member of the set — so the
+ * wire value is always exactly what hq-pro's validators expect. Note `apiKey`
+ * is camelCase on the wire, so the comparison set is keyed on the lowercased
+ * form and mapped back (see {@link canonicalizeOptionValue}).
+ */
+export function parseEnumOption(raw, allowed, flagName) {
+    if (raw === undefined)
+        return undefined;
+    const canonical = canonicalizeOptionValue(raw, allowed);
+    if (canonical === undefined) {
+        const legal = [...allowed].join(", ");
+        console.error(chalk.red(`Invalid ${flagName} '${raw}': must be one of ${legal}`));
+        process.exit(1);
+    }
+    return canonical;
+}
+/**
+ * Case-insensitively map `raw` onto its canonical member of `allowed`, or
+ * `undefined` when it is not a member. Split out from {@link parseEnumOption}
+ * so the mapping is unit-testable without a process exit.
+ */
+export function canonicalizeOptionValue(raw, allowed) {
+    const needle = raw.trim().toLowerCase();
+    for (const candidate of allowed) {
+        if (candidate.toLowerCase() === needle)
+            return candidate;
+    }
+    return undefined;
+}
 /**
  * A non-2xx from the `/v1/agents` control plane. Carries the HTTP status and
  * the registry error `code` (when present) so callers can branch — notably a
@@ -335,16 +390,28 @@ export function registerAgentsCommand(program) {
         .description("Provision a new cloud agent ($100/month — requires --yes)")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--slug <slug>", "Agent slug (defaults to a slug of <name>)")
-        .option("--provider <provider>", "Runtime: codex | grok (default codex)")
-        .option("--auth-mode <mode>", "Codex auth: subscription | apiKey (default subscription)", "subscription")
+        .option("--provider <provider>", "Runtime: codex | grok | claude (default codex). claude is subscription-only")
+        .option("--auth-mode <mode>", "Auth: subscription | apiKey (default subscription)", "subscription")
         .option("--api-key-env <VAR>", "Env var holding the API key for --auth-mode apiKey (never pass the key as a flag)")
         .option("--title <title>", "Org-chart job title")
         .option("--description <text>", "Short description / bio")
         .option("--yes", "Confirm the $100/month charge (required to provision)")
         .action(async function (name, opts) {
         try {
-            const authMode = opts.authMode === "apiKey" ? "apiKey" : "subscription";
-            const provider = opts.provider === "grok" ? "grok" : opts.provider ? "codex" : undefined;
+            // Both of these previously fell back to their default on an
+            // unrecognised value, silently provisioning a billable box the operator
+            // did not ask for. They now exit(1) instead — see parseEnumOption.
+            const authMode = parseEnumOption(opts.authMode, VALID_AUTH_MODES, "--auth-mode") ?? "subscription";
+            const provider = parseEnumOption(opts.provider, VALID_PROVIDERS, "--provider");
+            // claude is subscription-only on hq-pro (rejectIncompatibleProviderAuthMode
+            // returns AGENT_PROVIDER_INCOMPATIBLE_WITH_AUTH_MODE). Catch it here so the
+            // operator gets a direct message instead of a 400 from the control plane
+            // AFTER clearing the charge gate. The server stays authoritative; this is
+            // only a friendlier, earlier copy of the same rule.
+            if (provider === "claude" && authMode === "apiKey") {
+                console.error(chalk.red("The claude provider is subscription-only — drop --auth-mode apiKey."));
+                process.exit(1);
+            }
             // Resolve the API key from the environment (never from a flag value) when
             // apiKey mode is requested — validated BEFORE the paid gate so we don't
             // charge and then fail.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.97.2",
+  "version": "5.97.3-rc.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {