@indigoai-us/hq-cli 5.10.1 → 5.12.0

package/dist/utils/vault-api.js

@@ -1,6 +1,7 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4e482805-d129-5563-a77b-97b80410154b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e1ca2b83-1de0-5000-ab66-f573000a579b")}catch(e){}}();
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
+import { Sentry } from '../sentry.js';
 export async function vaultApiFetch(opts) {
     const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
     if (opts.query) {
@@ -8,14 +9,31 @@ export async function vaultApiFetch(opts) {
             url.searchParams.set(k, v);
         }
     }
-    return fetch(url.toString(), {
-        method: opts.method ?? 'GET',
+    const method = opts.method ?? 'GET';
+    const safeUrl = url.search ? `${url.origin}${url.pathname}?<redacted>` : `${url.origin}${url.pathname}`;
+    Sentry.addBreadcrumb({
+        category: "http",
+        message: `${method} ${opts.path}`,
+        level: "info",
+        data: { url: safeUrl, method },
+    });
+    const response = await fetch(url.toString(), {
+        method,
         headers: {
             Authorization: `Bearer ${opts.token}`,
             'Content-Type': 'application/json',
         },
         body: opts.body ? JSON.stringify(opts.body) : undefined,
     });
+    if (!response.ok) {
+        Sentry.addBreadcrumb({
+            category: "http",
+            message: `${method} ${opts.path} → ${response.status}`,
+            level: "warning",
+            data: { url: safeUrl, status: response.status },
+        });
+    }
+    return response;
 }
 async function resolveCompanyUid(token, slug) {
     const res = await vaultApiFetch({
@@ -54,5 +72,38 @@ export async function getCompanyUid(token, companySlug) {
     }
     return resolveCompanyFromMemberships(token);
 }
+// Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
+// createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
+export async function resolveCallerPersonUid(token) {
+    const res = await vaultApiFetch({
+        token,
+        path: '/entity/by-type/person',
+    });
+    if (!res.ok) {
+        throw new Error("Failed to fetch person entity — run `hq login` and try again");
+    }
+    const data = (await res.json());
+    const persons = (data.entities ?? []).filter((e) => e.type === 'person');
+    if (persons.length === 0) {
+        throw new Error('No person entity found for the caller. Sign in to HQ once to provision one.');
+    }
+    persons.sort((a, b) => {
+        const ac = a.createdAt ?? '';
+        const bc = b.createdAt ?? '';
+        if (ac !== bc)
+            return ac < bc ? -1 : 1;
+        return a.uid < b.uid ? -1 : 1;
+    });
+    return persons[0].uid;
+}
+// Resolves the scope UID (cmp_* or prs_*) for a secrets command. Precedence:
+// `--personal` → caller's canonical person entity; else `--company <slug>` →
+// resolved company UID; else fallback to single active company membership.
+export async function getEntityUid(token, opts) {
+    if (opts.personal) {
+        return resolveCallerPersonUid(token);
+    }
+    return getCompanyUid(token, opts.companySlug);
+}
 //# sourceMappingURL=vault-api.js.map
-//# debugId=4e482805-d129-5563-a77b-97b80410154b
+//# debugId=e1ca2b83-1de0-5000-ab66-f573000a579b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.10.1",
+  "version": "5.12.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -11,6 +11,7 @@
     "build": "node scripts/generate-dsn.mjs && tsc",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "vitest": "vitest",
     "clean": "rm -rf dist"
   },
   "dependencies": {

package/src/cli-version.ts

@@ -0,0 +1 @@
+export const CLI_VERSION = "5.12.0";

package/src/commands/cloud.ts

@@ -23,9 +23,11 @@ import {
   sync,
   readJournal,
   getJournalPath,
+  loadCachedTokens,
   type ConflictStrategy,
   type EntityContext,
   type SyncProgressEvent,
+  type UploadAuthor,
 } from "@indigoai-us/hq-cloud";
 
 import {
@@ -146,6 +148,14 @@ export function registerCloudCommands(program: Command): void {
                 emitJson(event as unknown as Record<string, unknown>)
             : undefined;
 
+          // Stamp every uploaded object's S3 user metadata with the syncing
+          // user's Cognito identity (`Metadata['created-by']`). The hq-console
+          // vault UI's CREATED BY column reads this back via HEAD; without it,
+          // every row renders `—`. Resolved best-effort from the cached
+          // idToken — pre-vended `--creds-from-stdin` paths still get author
+          // attribution as long as the caller is logged in locally.
+          const author = resolveUploadAuthorFromCache();
+
           const result = await share({
             paths: targetPaths,
             company: options.company,
@@ -155,6 +165,7 @@ export function registerCloudCommands(program: Command): void {
             entityContext,
             hqRoot: options.hqRoot,
             onEvent,
+            ...(author ? { author } : {}),
           });
 
           if (jsonMode) {
@@ -343,3 +354,32 @@ async function readAllStdin(): Promise<string> {
   }
   return Buffer.concat(chunks).toString("utf8");
 }
+
+/**
+ * Resolve the syncing user's `UploadAuthor` (sub + email) from the cached
+ * Cognito idToken. Returns `undefined` when no tokens are cached or the
+ * token is missing the required claims — share() then skips the metadata
+ * stamp gracefully (not an error).
+ *
+ * We deliberately decode the JWT here instead of verifying it: Cognito
+ * already verified at issuance, and we only use the public claims to
+ * label the upload's S3 user metadata (no auth decision rides on it).
+ */
+function resolveUploadAuthorFromCache(): UploadAuthor | undefined {
+  const tokens = loadCachedTokens();
+  if (!tokens?.idToken) return undefined;
+  const parts = tokens.idToken.split(".");
+  if (parts.length !== 3) return undefined;
+  try {
+    const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = payload + "=".repeat((4 - (payload.length % 4)) % 4);
+    const json = Buffer.from(padded, "base64").toString("utf-8");
+    const claims = JSON.parse(json) as { sub?: string; email?: string };
+    if (claims.sub && claims.email) {
+      return { userSub: claims.sub, email: claims.email };
+    }
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}

package/src/commands/feedback.test.ts

@@ -0,0 +1,369 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { Readable } from "node:stream";
+import { Command } from "commander";
+
+vi.mock("../utils/cognito-session.js", () => ({
+  ensureCognitoToken: vi.fn(),
+}));
+
+vi.mock("../utils/vault-api.js", () => ({
+  vaultApiFetch: vi.fn(),
+}));
+
+vi.mock("../utils/feedback-diagnostics.js", () => ({
+  collectDiagnostics: vi.fn(() => ({
+    cliVersion: "5.11.0",
+    nodeVersion: process.version,
+    os: { platform: "linux", release: "5.15.0", arch: "x64" },
+    command: ["feedback", "bug"],
+    cwd: "/home/user",
+    git: { branch: "main", head: "abc1234", dirty: false, remoteUrl: null },
+    recentSentryBreadcrumbs: [],
+  })),
+}));
+
+vi.mock("node:fs", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("node:fs")>();
+  return {
+    ...actual,
+    promises: {
+      ...actual.promises,
+      readFile: vi.fn(),
+    },
+  };
+});
+
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+import * as fs from "node:fs";
+import {
+  submitFeedback,
+  readBodyFile,
+  registerFeedbackCommand,
+  BODY_MAX_BYTES,
+} from "./feedback.js";
+
+function jsonResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+const mockEnsureCognitoToken = vi.mocked(ensureCognitoToken);
+const mockVaultApiFetch = vi.mocked(vaultApiFetch);
+const mockCollectDiagnostics = vi.mocked(collectDiagnostics);
+const mockReadFile = vi.mocked(fs.promises.readFile);
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mockCollectDiagnostics.mockReturnValue({
+    cliVersion: "5.11.0",
+    nodeVersion: process.version,
+    os: { platform: "linux", release: "5.15.0", arch: "x64" },
+    command: ["feedback", "bug"],
+    cwd: "/home/user",
+    git: { branch: "main", head: "abc1234", dirty: false, remoteUrl: null },
+    recentSentryBreadcrumbs: [],
+  });
+});
+
+// ---------------------------------------------------------------------------
+// submitFeedback
+// ---------------------------------------------------------------------------
+
+describe("submitFeedback", () => {
+  it("returns the id from a successful bug submission", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(
+      jsonResponse(200, { id: "feedback_abc123" }),
+    );
+
+    const result = await submitFeedback({
+      type: "bug",
+      title: "Something broke",
+      body: "Details here",
+      token: "test-token",
+    });
+
+    expect(result.id).toBe("feedback_abc123");
+  });
+
+  it("sends type=feature for feature requests", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(
+      jsonResponse(200, { id: "feedback_feature1" }),
+    );
+
+    await submitFeedback({
+      type: "feature",
+      title: "Add dark mode",
+      body: "Would be great",
+      token: "test-token",
+    });
+
+    const call = mockVaultApiFetch.mock.calls[0][0];
+    expect(call.body).toMatchObject({ type: "feature" });
+  });
+
+  it("sends POST to /v1/feedback with the correct title and body", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(
+      jsonResponse(200, { id: "feedback_xyz" }),
+    );
+
+    await submitFeedback({
+      type: "bug",
+      title: "My title",
+      body: "My body text",
+      token: "tok",
+    });
+
+    const call = mockVaultApiFetch.mock.calls[0][0];
+    expect(call.path).toBe("/v1/feedback");
+    expect(call.method).toBe("POST");
+    expect(call.body).toMatchObject({ title: "My title", body: "My body text" });
+  });
+
+  it("includes company when provided", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(
+      jsonResponse(200, { id: "feedback_co1" }),
+    );
+
+    await submitFeedback({
+      type: "bug",
+      title: "Bug with company",
+      body: "Details",
+      company: "acme",
+      token: "tok",
+    });
+
+    const call = mockVaultApiFetch.mock.calls[0][0];
+    expect((call.body as Record<string, unknown>).company).toBe("acme");
+  });
+
+  it("omits company key when not provided", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(
+      jsonResponse(200, { id: "feedback_noco" }),
+    );
+
+    await submitFeedback({
+      type: "bug",
+      title: "No company",
+      body: "Details",
+      token: "tok",
+    });
+
+    const call = mockVaultApiFetch.mock.calls[0][0];
+    expect((call.body as Record<string, unknown>)).not.toHaveProperty("company");
+  });
+
+  it("attaches diagnostics from collectDiagnostics to the request body", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(
+      jsonResponse(200, { id: "feedback_diag" }),
+    );
+
+    await submitFeedback({
+      type: "bug",
+      title: "With diag",
+      body: "Body",
+      token: "tok",
+    });
+
+    expect(mockCollectDiagnostics).toHaveBeenCalledOnce();
+    const call = mockVaultApiFetch.mock.calls[0][0];
+    expect((call.body as Record<string, unknown>).diagnostics).toBeDefined();
+    expect(
+      ((call.body as Record<string, unknown>).diagnostics as Record<string, unknown>).cliVersion,
+    ).toBe("5.11.0");
+  });
+
+  it("throws with the error from the response body on non-2xx", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(
+      jsonResponse(400, { error: "title too long" }),
+    );
+
+    await expect(
+      submitFeedback({
+        type: "bug",
+        title: "Bad",
+        body: "Body",
+        token: "tok",
+      }),
+    ).rejects.toThrow("title too long");
+  });
+
+  it("throws with statusText when response has no parseable error body", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(
+      new Response("internal error", { status: 500, statusText: "Internal Server Error" }),
+    );
+
+    await expect(
+      submitFeedback({
+        type: "bug",
+        title: "Server fail",
+        body: "Body",
+        token: "tok",
+      }),
+    ).rejects.toThrow(/Internal Server Error/);
+  });
+
+  it("throws before fetching when body exceeds 64 KiB", async () => {
+    const largeBody = "x".repeat(BODY_MAX_BYTES + 1);
+
+    await expect(
+      submitFeedback({
+        type: "bug",
+        title: "Big body",
+        body: largeBody,
+        token: "tok",
+      }),
+    ).rejects.toThrow(/64 KiB limit/);
+
+    expect(mockVaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("accepts a body exactly at the 64 KiB limit", async () => {
+    const exactBody = "x".repeat(BODY_MAX_BYTES);
+    mockVaultApiFetch.mockResolvedValueOnce(
+      jsonResponse(200, { id: "feedback_exact" }),
+    );
+
+    const result = await submitFeedback({
+      type: "bug",
+      title: "Exact size",
+      body: exactBody,
+      token: "tok",
+    });
+
+    expect(result.id).toBe("feedback_exact");
+  });
+
+  it("throws before fetching when body is empty or whitespace-only", async () => {
+    await expect(
+      submitFeedback({
+        type: "bug",
+        title: "Empty",
+        body: "   \n\t  ",
+        token: "tok",
+      }),
+    ).rejects.toThrow(/must not be empty/);
+
+    expect(mockVaultApiFetch).not.toHaveBeenCalled();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// readBodyFile
+// ---------------------------------------------------------------------------
+
+describe("readBodyFile", () => {
+  it("reads content from a file path", async () => {
+    mockReadFile.mockResolvedValueOnce("file body content" as never);
+
+    const content = await readBodyFile("/tmp/body.md");
+
+    expect(mockReadFile).toHaveBeenCalledWith("/tmp/body.md", "utf-8");
+    expect(content).toBe("file body content");
+  });
+
+  it('reads content from stdin when path is "-"', async () => {
+    const mockStdin = new Readable({
+      read() {
+        this.push("stdin content");
+        this.push(null);
+      },
+    });
+
+    const content = await readBodyFile("-", mockStdin as NodeJS.ReadableStream);
+
+    expect(content).toBe("stdin content");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// registerFeedbackCommand — action integration
+// ---------------------------------------------------------------------------
+
+describe("registerFeedbackCommand — action integration", () => {
+  function makeProgram(): Command {
+    const p = new Command();
+    p.exitOverride();
+    registerFeedbackCommand(p);
+    return p;
+  }
+
+  beforeEach(() => {
+    mockEnsureCognitoToken.mockResolvedValue("test-token");
+  });
+
+  it("success: prints Submitted: <id> and does not call process.exit", async () => {
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+    const exitSpy = vi.spyOn(process, "exit").mockImplementation(() => undefined as never);
+    mockReadFile.mockResolvedValueOnce("Valid bug report body." as never);
+    mockVaultApiFetch.mockResolvedValueOnce(jsonResponse(200, { id: "feedback_abc123" }));
+
+    await makeProgram().parseAsync([
+      "node", "hq", "feedback", "bug",
+      "--title", "Test bug",
+      "--body-file", "/tmp/body.md",
+    ]);
+
+    expect(logSpy).toHaveBeenCalledWith("Submitted: feedback_abc123");
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+
+  it("error: API error routes to chalk error prefix and process.exit(1)", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = vi.spyOn(process, "exit").mockImplementation(() => undefined as never);
+    mockReadFile.mockResolvedValueOnce("Some body text." as never);
+    mockVaultApiFetch.mockResolvedValueOnce(jsonResponse(400, { error: "title too long" }));
+
+    await makeProgram().parseAsync([
+      "node", "hq", "feedback", "bug",
+      "--title", "Bad",
+      "--body-file", "/tmp/body.md",
+    ]);
+
+    expect(errSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Error"),
+      expect.stringContaining("title too long"),
+    );
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+
+  it("auth error: ensureCognitoToken throws → chalk error prefix and process.exit(1)", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = vi.spyOn(process, "exit").mockImplementation(() => undefined as never);
+    mockEnsureCognitoToken.mockRejectedValueOnce(new Error("not authenticated"));
+
+    await makeProgram().parseAsync([
+      "node", "hq", "feedback", "feature",
+      "--title", "Nice feat",
+      "--body-file", "/tmp/body.md",
+    ]);
+
+    expect(errSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Error"),
+      "not authenticated",
+    );
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+
+  it("oversize body: submitFeedback throws 64 KiB error → process.exit(1)", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = vi.spyOn(process, "exit").mockImplementation(() => undefined as never);
+    const largeBody = "x".repeat(BODY_MAX_BYTES + 1);
+    mockReadFile.mockResolvedValueOnce(largeBody as never);
+
+    await makeProgram().parseAsync([
+      "node", "hq", "feedback", "bug",
+      "--title", "Big",
+      "--body-file", "/tmp/big.md",
+    ]);
+
+    expect(errSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Error"),
+      expect.stringContaining("64 KiB limit"),
+    );
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+});

package/src/commands/feedback.ts

@@ -0,0 +1,136 @@
+import * as fs from "node:fs";
+import { Command } from "commander";
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+
+export const BODY_MAX_BYTES = 64 * 1024;
+
+export interface FeedbackResult {
+  id: string;
+}
+
+export interface FeedbackSubmitOptions {
+  type: "bug" | "feature";
+  title: string;
+  body: string;
+  company?: string;
+  token: string;
+}
+
+export async function readBodyFile(
+  bodyFile: string,
+  stdin?: NodeJS.ReadableStream,
+): Promise<string> {
+  if (bodyFile === "-") {
+    const stream = stdin ?? process.stdin;
+    if ((stream as NodeJS.ReadStream).isTTY) {
+      throw new Error(
+        "--body-file - requires piped stdin (got interactive terminal).",
+      );
+    }
+    return new Promise((resolve, reject) => {
+      let data = "";
+      stream.setEncoding("utf8");
+      stream.on("data", (chunk: string) => {
+        data += chunk;
+      });
+      stream.on("end", () => resolve(data));
+      stream.on("error", reject);
+    });
+  }
+  return fs.promises.readFile(bodyFile, "utf-8");
+}
+
+export async function submitFeedback(
+  opts: FeedbackSubmitOptions,
+): Promise<FeedbackResult> {
+  if (opts.body.trim().length === 0) {
+    throw new Error(
+      "body must not be empty. Provide at least one non-whitespace character.",
+    );
+  }
+
+  const bodyBytes = Buffer.byteLength(opts.body, "utf8");
+  if (bodyBytes > BODY_MAX_BYTES) {
+    throw new Error(
+      `Body exceeds 64 KiB limit (${bodyBytes} bytes). Reduce the body size before submitting.`,
+    );
+  }
+
+  const diagnostics = collectDiagnostics();
+
+  const requestBody: Record<string, unknown> = {
+    type: opts.type,
+    title: opts.title,
+    body: opts.body,
+    diagnostics,
+  };
+  if (opts.company) {
+    requestBody.company = opts.company;
+  }
+
+  const res = await vaultApiFetch({
+    token: opts.token,
+    path: "/v1/feedback",
+    method: "POST",
+    body: requestBody,
+  });
+
+  if (!res.ok) {
+    const data = await res.json().catch(() => ({}));
+    const errMsg =
+      data &&
+      typeof data === "object" &&
+      !Array.isArray(data) &&
+      typeof (data as { error?: unknown }).error === "string"
+        ? (data as { error: string }).error
+        : res.statusText;
+    throw new Error(`Failed to submit feedback: ${errMsg}`);
+  }
+
+  const data = (await res.json()) as { id: string };
+  return { id: data.id };
+}
+
+function registerSubcommand(feedbackCmd: Command, type: "bug" | "feature"): void {
+  feedbackCmd
+    .command(type)
+    .description(type === "bug" ? "Report a bug" : "Request a feature")
+    .requiredOption("--title <text>", "Short title for the report")
+    .requiredOption(
+      "--body-file <path>",
+      "Path to a markdown file with the body; use - to read from stdin",
+    )
+    .option("--company <slug>", "Company slug to associate with the report")
+    .action(async (opts: { title: string; bodyFile: string; company?: string }) => {
+      try {
+        const token = await ensureCognitoToken({ interactive: false });
+        const body = await readBodyFile(opts.bodyFile);
+        const result = await submitFeedback({
+          type,
+          title: opts.title,
+          body,
+          company: opts.company,
+          token,
+        });
+        console.log(`Submitted: ${result.id}`);
+      } catch (err) {
+        console.error(
+          chalk.red("Error:"),
+          err instanceof Error ? err.message : String(err),
+        );
+        process.exit(1);
+      }
+    });
+}
+
+export function registerFeedbackCommand(program: Command): void {
+  const feedbackCmd = program
+    .command("feedback")
+    .description("Submit a bug report or feature request to HQ");
+
+  registerSubcommand(feedbackCmd, "bug");
+  registerSubcommand(feedbackCmd, "feature");
+}