@indigoai-us/hq-cli 5.10.1 → 5.12.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## [5.12.0] — 2026-05-08
+
+### Added
+
+- **`hq feedback` command group** — two subcommands `hq feedback bug` and
+  `hq feedback feature` let any logged-in user submit structured feedback without
+  leaving the terminal. Submissions are JWT-authenticated via the existing Cognito
+  session (no additional login step).
+
+- **`--body-file <path>` flag** — pass a pre-written markdown file as the feedback
+  body. Multi-line input without shell quoting headaches. Use `--body-file -` to read
+  from stdin (useful for piped workflows). Body input is file-based by design (no
+  inline string flag).
+
+- **`--company <slug>` flag (optional)** — attaches a company context to the submission.
+  Resolved automatically from `core/scripts/hq-session.sh get company_slug` inside the
+  `/feedback` skill; the flag is omitted when the slug is empty.
+
+- **Diagnostics blob** — every submission includes a structured diagnostics payload
+  (`cliVersion`, `nodeVersion`, `os.platform`, `os.release`, `command` argv array,
+  `cwd`, `recentSentryBreadcrumbs`). Purely plain CLI/process context — no GHQ-OS-aware
+  identifiers.
+
+- **Slack relay** — the vault-service backend best-effort posts a formatted card to
+  `#hq-feedback` after writing the DynamoDB row. Relay is fire-and-forget; Slack
+  failures do not affect the HTTP response.
+
+### Example
+
+```bash
+# Interactive: title prompted if not supplied
+hq feedback bug --title "search broken on mobile"
+
+# Scripted: body from a pre-written file
+hq feedback feature --title "dark mode" --body-file /tmp/feature-body.md
+
+# Piped: read body from stdin
+echo "Steps to reproduce: ..." | hq feedback bug --title "crash on login" --body-file -
+```
+
+## [5.11.0] — 2026-05-07
+
+### Added
+
+- **`--personal` flag for `hq secrets`** — pin a secret to the per-user store rather
+  than the company store. See commit `b5ec9bd` ("release: hq-cli@5.11.0 — --personal
+  flag for secrets") for details.
+
 ## [5.10.0] — 2026-05-04
 
 ### Added

package/dist/cli-version.d.ts

@@ -0,0 +1,2 @@
+export declare const CLI_VERSION = "5.12.0";
+//# sourceMappingURL=cli-version.d.ts.map

package/dist/cli-version.js

@@ -0,0 +1,5 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f65738b2-fa67-5b68-a0c8-c73fba12c6c5")}catch(e){}}();
+export const CLI_VERSION = "5.12.0";
+//# sourceMappingURL=cli-version.js.map
+//# debugId=f65738b2-fa67-5b68-a0c8-c73fba12c6c5

package/dist/commands/cloud.js

@@ -13,11 +13,11 @@
  *   hq sync status            — show local journal summary
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5ddbce6a-fdde-506e-8cdd-2e5b0ad20fff")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="213f074e-13c2-5b95-9519-813adf9adfa9")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, sync, readJournal, getJournalPath, } from "@indigoai-us/hq-cloud";
+import { share, sync, readJournal, getJournalPath, loadCachedTokens, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 export function registerCloudCommands(program) {
     program
@@ -85,6 +85,13 @@ export function registerCloudCommands(program) {
             const onEvent = jsonMode
                 ? (event) => emitJson(event)
                 : undefined;
+            // Stamp every uploaded object's S3 user metadata with the syncing
+            // user's Cognito identity (`Metadata['created-by']`). The hq-console
+            // vault UI's CREATED BY column reads this back via HEAD; without it,
+            // every row renders `—`. Resolved best-effort from the cached
+            // idToken — pre-vended `--creds-from-stdin` paths still get author
+            // attribution as long as the caller is logged in locally.
+            const author = resolveUploadAuthorFromCache();
             const result = await share({
                 paths: targetPaths,
                 company: options.company,
@@ -94,6 +101,7 @@ export function registerCloudCommands(program) {
                 entityContext,
                 hqRoot: options.hqRoot,
                 onEvent,
+                ...(author ? { author } : {}),
             });
             if (jsonMode) {
                 // Synthetic terminal event so subprocess consumers can read final
@@ -226,5 +234,36 @@ async function readAllStdin() {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
+/**
+ * Resolve the syncing user's `UploadAuthor` (sub + email) from the cached
+ * Cognito idToken. Returns `undefined` when no tokens are cached or the
+ * token is missing the required claims — share() then skips the metadata
+ * stamp gracefully (not an error).
+ *
+ * We deliberately decode the JWT here instead of verifying it: Cognito
+ * already verified at issuance, and we only use the public claims to
+ * label the upload's S3 user metadata (no auth decision rides on it).
+ */
+function resolveUploadAuthorFromCache() {
+    const tokens = loadCachedTokens();
+    if (!tokens?.idToken)
+        return undefined;
+    const parts = tokens.idToken.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const padded = payload + "=".repeat((4 - (payload.length % 4)) % 4);
+        const json = Buffer.from(padded, "base64").toString("utf-8");
+        const claims = JSON.parse(json);
+        if (claims.sub && claims.email) {
+            return { userSub: claims.sub, email: claims.email };
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=cloud.js.map
-//# debugId=5ddbce6a-fdde-506e-8cdd-2e5b0ad20fff
+//# debugId=213f074e-13c2-5b95-9519-813adf9adfa9

package/dist/commands/feedback.d.ts

@@ -0,0 +1,16 @@
+import { Command } from "commander";
+export declare const BODY_MAX_BYTES: number;
+export interface FeedbackResult {
+    id: string;
+}
+export interface FeedbackSubmitOptions {
+    type: "bug" | "feature";
+    title: string;
+    body: string;
+    company?: string;
+    token: string;
+}
+export declare function readBodyFile(bodyFile: string, stdin?: NodeJS.ReadableStream): Promise<string>;
+export declare function submitFeedback(opts: FeedbackSubmitOptions): Promise<FeedbackResult>;
+export declare function registerFeedbackCommand(program: Command): void;
+//# sourceMappingURL=feedback.d.ts.map

package/dist/commands/feedback.js

@@ -0,0 +1,98 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4")}catch(e){}}();
+import * as fs from "node:fs";
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+export const BODY_MAX_BYTES = 64 * 1024;
+export async function readBodyFile(bodyFile, stdin) {
+    if (bodyFile === "-") {
+        const stream = stdin ?? process.stdin;
+        if (stream.isTTY) {
+            throw new Error("--body-file - requires piped stdin (got interactive terminal).");
+        }
+        return new Promise((resolve, reject) => {
+            let data = "";
+            stream.setEncoding("utf8");
+            stream.on("data", (chunk) => {
+                data += chunk;
+            });
+            stream.on("end", () => resolve(data));
+            stream.on("error", reject);
+        });
+    }
+    return fs.promises.readFile(bodyFile, "utf-8");
+}
+export async function submitFeedback(opts) {
+    if (opts.body.trim().length === 0) {
+        throw new Error("body must not be empty. Provide at least one non-whitespace character.");
+    }
+    const bodyBytes = Buffer.byteLength(opts.body, "utf8");
+    if (bodyBytes > BODY_MAX_BYTES) {
+        throw new Error(`Body exceeds 64 KiB limit (${bodyBytes} bytes). Reduce the body size before submitting.`);
+    }
+    const diagnostics = collectDiagnostics();
+    const requestBody = {
+        type: opts.type,
+        title: opts.title,
+        body: opts.body,
+        diagnostics,
+    };
+    if (opts.company) {
+        requestBody.company = opts.company;
+    }
+    const res = await vaultApiFetch({
+        token: opts.token,
+        path: "/v1/feedback",
+        method: "POST",
+        body: requestBody,
+    });
+    if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        const errMsg = data &&
+            typeof data === "object" &&
+            !Array.isArray(data) &&
+            typeof data.error === "string"
+            ? data.error
+            : res.statusText;
+        throw new Error(`Failed to submit feedback: ${errMsg}`);
+    }
+    const data = (await res.json());
+    return { id: data.id };
+}
+function registerSubcommand(feedbackCmd, type) {
+    feedbackCmd
+        .command(type)
+        .description(type === "bug" ? "Report a bug" : "Request a feature")
+        .requiredOption("--title <text>", "Short title for the report")
+        .requiredOption("--body-file <path>", "Path to a markdown file with the body; use - to read from stdin")
+        .option("--company <slug>", "Company slug to associate with the report")
+        .action(async (opts) => {
+        try {
+            const token = await ensureCognitoToken({ interactive: false });
+            const body = await readBodyFile(opts.bodyFile);
+            const result = await submitFeedback({
+                type,
+                title: opts.title,
+                body,
+                company: opts.company,
+                token,
+            });
+            console.log(`Submitted: ${result.id}`);
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+export function registerFeedbackCommand(program) {
+    const feedbackCmd = program
+        .command("feedback")
+        .description("Submit a bug report or feature request to HQ");
+    registerSubcommand(feedbackCmd, "bug");
+    registerSubcommand(feedbackCmd, "feature");
+}
+//# sourceMappingURL=feedback.js.map
+//# debugId=3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4

package/dist/commands/secrets.d.ts

@@ -1,6 +1,6 @@
 import { Command } from "commander";
-import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
-export { vaultApiFetch, getCompanyUid };
+export { vaultApiFetch, getCompanyUid, getEntityUid };
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,13 +1,26 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0239c476-98b8-53c0-9458-1c82dc0d26a9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="217ceadb-01cd-5778-9cc0-6f6d895d8d67")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
-import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
-export { vaultApiFetch, getCompanyUid };
+import { vaultApiFetch, getCompanyUid, getEntityUid, } from "../utils/vault-api.js";
+export { vaultApiFetch, getCompanyUid, getEntityUid };
+function scopeOpts(opts) {
+    if (opts.personal && opts.company) {
+        console.error(chalk.red("Error: --personal cannot be combined with --company."));
+        process.exit(1);
+    }
+    return { personal: !!opts.personal, companySlug: opts.company };
+}
+function rejectIfPersonal(opts, action) {
+    if (opts.personal) {
+        console.error(chalk.red(`Error: ${action} is not supported with --personal.`));
+        process.exit(1);
+    }
+}
 function shellSingleQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
@@ -115,7 +128,8 @@ export function registerSecretsCommand(program) {
     const secrets = program
         .command("secrets")
         .description("Manage secrets in HQ vault (SSM Parameter Store)")
-        .option("--company <slug>", "Company slug (resolves to companyUid)");
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--personal", "Operate on the caller's personal vault (no sharing)");
     secrets
         .command("set <name>")
         .description("Create or update a secret")
@@ -150,8 +164,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}`,
@@ -178,8 +191,7 @@ export function registerSecretsCommand(program) {
         .action(async (name, opts) => {
         try {
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const query = {};
             if (opts.reveal) {
                 query.reveal = "true";
@@ -233,8 +245,7 @@ export function registerSecretsCommand(program) {
                 normalizedPrefix = normalized;
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const query = {};
             if (normalizedPrefix) {
                 query.prefix = normalizedPrefix;
@@ -298,8 +309,7 @@ export function registerSecretsCommand(program) {
                 }
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: buildSecretNamePath(companyUid, name),
@@ -350,8 +360,7 @@ export function registerSecretsCommand(program) {
                 }
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const revealed = await Promise.all(keys.map(async (key) => {
                 const cached = readCache(companyUid, key);
                 if (cached !== null) {
@@ -420,8 +429,7 @@ export function registerSecretsCommand(program) {
                 }
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const revealed = await Promise.all(keys.map(async (key) => {
                 const cached = readCache(companyUid, key);
                 if (cached !== null) {
@@ -459,6 +467,7 @@ export function registerSecretsCommand(program) {
         .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
         .action(async (name, opts) => {
         try {
+            rejectIfPersonal(secrets.opts(), "generate-link");
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
@@ -474,8 +483,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: buildSecretNamePath(companyUid, name),
@@ -507,6 +515,7 @@ export function registerSecretsCommand(program) {
         .requiredOption("--permission <level>", "Permission level: read | write | admin")
         .action(async (path, opts) => {
         try {
+            rejectIfPersonal(secrets.opts(), "share");
             if (!SECRET_NAME_PATTERN.test(path)) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
@@ -523,8 +532,7 @@ export function registerSecretsCommand(program) {
             const granteeType = isEmail ? "email" : "group";
             const granteeId = opts.with;
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}/acl/grant`,
@@ -566,6 +574,7 @@ export function registerSecretsCommand(program) {
         .requiredOption("--from <principal>", "Email address or group id to remove")
         .action(async (path, opts) => {
         try {
+            rejectIfPersonal(secrets.opts(), "unshare");
             if (!SECRET_NAME_PATTERN.test(path)) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
@@ -578,8 +587,7 @@ export function registerSecretsCommand(program) {
             const granteeType = isEmailFrom ? "email" : "group";
             const granteeId = opts.from;
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}/acl/revoke`,
@@ -618,13 +626,13 @@ export function registerSecretsCommand(program) {
         .description("Show the ACL (access control list) for a secret path")
         .action(async (path) => {
         try {
+            rejectIfPersonal(secrets.opts(), "acl");
             if (!SECRET_NAME_PATTERN.test(path)) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const secretPath = path;
             const res = await vaultApiFetch({
                 token,
@@ -705,4 +713,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=0239c476-98b8-53c0-9458-1c82dc0d26a9
+//# debugId=217ceadb-01cd-5778-9cc0-6f6d895d8d67

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e834c407-cd5c-5dc1-af3b-7f041af651ef")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="65033669-3ba8-5aac-8a98-49827f627ff9")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -28,12 +28,14 @@ import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerMembersCommand } from "./commands/members.js";
+import { registerFeedbackCommand } from "./commands/feedback.js";
+import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 initSentry();
 const program = new Command();
 program
     .name("hq")
     .description("HQ management CLI — modules, packages, and cloud sync")
-    .version("5.8.6");
+    .version("5.12.0");
 // Module management subcommand group
 const modulesCmd = program
     .command("modules")
@@ -86,8 +88,15 @@ registerFilesCommand(program);
 registerMembersCommand(program);
 // Onboarding (top-level — Cognito + vault-service provisioning)
 registerOnboardCommand(program);
+// Feedback (subcommand group — hq feedback bug|feature)
+registerFeedbackCommand(program);
 (async () => {
     try {
+        Sentry.addBreadcrumb({
+            category: "command",
+            message: sanitizeArgv(process.argv.slice(2)).join(" "),
+            level: "info",
+        });
         await program.parseAsync();
     }
     catch (err) {
@@ -99,4 +108,4 @@ registerOnboardCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=e834c407-cd5c-5dc1-af3b-7f041af651ef
+//# debugId=65033669-3ba8-5aac-8a98-49827f627ff9

package/dist/sentry.js

@@ -1,8 +1,9 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9a31fb53-8cc1-5394-ac16-e96b82fa6caa")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="508ac88d-5683-5d1f-9857-80a8a74e03e2")}catch(e){}}();
 import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
+import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
 export function initSentry() {
     const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
     if (!dsn)
@@ -15,8 +16,9 @@ export function initSentry() {
             tags: { repo: "hq-cli" },
         },
         beforeSend,
+        beforeBreadcrumb,
     });
 }
 export { Sentry };
 //# sourceMappingURL=sentry.js.map
-//# debugId=9a31fb53-8cc1-5394-ac16-e96b82fa6caa
+//# debugId=508ac88d-5683-5d1f-9857-80a8a74e03e2

package/dist/utils/breadcrumb-buffer.d.ts

@@ -0,0 +1,4 @@
+import type { Breadcrumb } from "@sentry/node";
+export declare function beforeBreadcrumb(breadcrumb: Breadcrumb): Breadcrumb | null;
+export declare function getRecentBreadcrumbs(): Breadcrumb[];
+//# sourceMappingURL=breadcrumb-buffer.d.ts.map

package/dist/utils/breadcrumb-buffer.js

@@ -0,0 +1,18 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6a54e8f0-10de-59c2-82d9-22de94d9e6f2")}catch(e){}}();
+const BUFFER_SIZE = 20;
+const _buffer = [];
+// Sentry beforeBreadcrumb hook: records every breadcrumb in a ring buffer
+// and returns it unchanged so Sentry still processes it normally.
+export function beforeBreadcrumb(breadcrumb) {
+    _buffer.push(breadcrumb);
+    if (_buffer.length > BUFFER_SIZE) {
+        _buffer.shift();
+    }
+    return breadcrumb;
+}
+export function getRecentBreadcrumbs() {
+    return [..._buffer];
+}
+//# sourceMappingURL=breadcrumb-buffer.js.map
+//# debugId=6a54e8f0-10de-59c2-82d9-22de94d9e6f2

package/dist/utils/feedback-diagnostics.d.ts

@@ -0,0 +1,22 @@
+export interface GitContext {
+    branch: string | null;
+    head: string | null;
+    dirty: boolean;
+    remoteUrl: string | null;
+}
+export interface DiagnosticsBlob {
+    cliVersion: string;
+    nodeVersion: string;
+    os: {
+        platform: string;
+        release: string;
+        arch: string;
+    };
+    command: string[];
+    cwd: string;
+    git: GitContext;
+    recentSentryBreadcrumbs: unknown[];
+}
+export declare function sanitizeArgv(argv: string[]): string[];
+export declare function collectDiagnostics(): DiagnosticsBlob;
+//# sourceMappingURL=feedback-diagnostics.d.ts.map

package/dist/utils/feedback-diagnostics.js

@@ -0,0 +1,95 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ee39c63b-ddaa-553d-b5db-77633d323d88")}catch(e){}}();
+import * as os from "os";
+import { execFileSync } from "child_process";
+import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
+import { CLI_VERSION } from "../cli-version.js";
+const SECRET_FLAGS = new Set([
+    "--token",
+    "--secret",
+    "--password",
+    "--key",
+    "--api-key",
+    "--access-token",
+    "--auth-token",
+]);
+export function sanitizeArgv(argv) {
+    const result = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg.startsWith("--") && arg.includes("=")) {
+            const eqIdx = arg.indexOf("=");
+            const flag = arg.slice(0, eqIdx);
+            if (SECRET_FLAGS.has(flag)) {
+                result.push(`${flag}=***`);
+                continue;
+            }
+        }
+        result.push(arg);
+        if (SECRET_FLAGS.has(arg) && i + 1 < argv.length) {
+            result.push("***");
+            i++;
+        }
+    }
+    return result;
+}
+function sanitizeRemoteUrl(url) {
+    return url.replace(/https?:\/\/[^@]+@/, "https://***@");
+}
+function runGit(args) {
+    return execFileSync("git", args, {
+        encoding: "utf-8",
+        timeout: 2000,
+        stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+}
+function collectGitContext() {
+    let branch = null;
+    let head = null;
+    let dirty = false;
+    let remoteUrl = null;
+    try {
+        branch = runGit(["rev-parse", "--abbrev-ref", "HEAD"]);
+    }
+    catch {
+        return { branch: null, head: null, dirty: false, remoteUrl: null };
+    }
+    try {
+        head = runGit(["rev-parse", "--short", "HEAD"]);
+    }
+    catch {
+        // best-effort
+    }
+    try {
+        const statusOut = runGit(["status", "--porcelain"]);
+        dirty = statusOut.length > 0;
+    }
+    catch {
+        // best-effort
+    }
+    try {
+        const raw = runGit(["remote", "get-url", "origin"]);
+        remoteUrl = sanitizeRemoteUrl(raw);
+    }
+    catch {
+        // no origin remote
+    }
+    return { branch, head, dirty, remoteUrl };
+}
+export function collectDiagnostics() {
+    return {
+        cliVersion: CLI_VERSION,
+        nodeVersion: process.version,
+        os: {
+            platform: os.platform(),
+            release: os.release(),
+            arch: os.arch(),
+        },
+        command: sanitizeArgv(process.argv.slice(2)),
+        cwd: process.cwd(),
+        git: collectGitContext(),
+        recentSentryBreadcrumbs: getRecentBreadcrumbs(),
+    };
+}
+//# sourceMappingURL=feedback-diagnostics.js.map
+//# debugId=ee39c63b-ddaa-553d-b5db-77633d323d88

package/dist/utils/vault-api.d.ts

@@ -7,4 +7,9 @@ export interface VaultApiOptions {
 }
 export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
 export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+export declare function resolveCallerPersonUid(token: string): Promise<string>;
+export declare function getEntityUid(token: string, opts: {
+    personal?: boolean;
+    companySlug?: string;
+}): Promise<string>;
 //# sourceMappingURL=vault-api.d.ts.map