@indigoai-us/hq-cloud 6.11.14 → 6.11.16

package/src/vault-client.ts

@@ -114,6 +114,30 @@ export interface EntityInfo {
   createdAt: string;
 }
 
+/**
+ * Pick the caller's OWN entity for the `--personal` slot when the runner is an
+ * agent machine identity (username `machine-agt_*`, idToken
+ * `custom:entityType=agent` / `custom:entityUid=agt_*`).
+ *
+ * The person-only `pickCanonicalPersonEntity` filters `type === "person"`, so
+ * an agent's own entity (`type: "agent"`) is dropped and `--personal` for an
+ * agent emits `setup-needed` — never reaching the STS vend / S3 read (the
+ * US-004 hard-gate finding). This selector resolves the agent's own entity by
+ * matching `selfUid` (the `custom:entityUid` claim) against the self-listing
+ * the agent sees, so the personal slot resolves to `hq-vault-agt-<uid>`.
+ *
+ * Returns null when no entity matches the claimed self-uid (the caller then
+ * falls back to the person-only pick / `setup-needed`, exactly as before).
+ */
+export function pickAgentSelfEntity(
+  list: EntityInfo[],
+  selfUid: string,
+): EntityInfo | null {
+  if (!selfUid) return null;
+  const own = list.find((e) => e.uid === selfUid && e.type === "agent");
+  return own ?? null;
+}
+
 export function pickCanonicalPersonEntity(
   list: EntityInfo[],
 ): EntityInfo | null {