@indigoai-us/hq-cli 5.10.1 → 5.12.0

package/src/commands/secrets.ts

@@ -10,9 +10,40 @@ import {
   clearAllCache,
 } from "../utils/secrets-cache.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
-import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import {
+  vaultApiFetch,
+  getCompanyUid,
+  getEntityUid,
+} from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
-export { vaultApiFetch, getCompanyUid };
+export { vaultApiFetch, getCompanyUid, getEntityUid };
+
+interface SecretsScopeOpts {
+  company?: string;
+  personal?: boolean;
+}
+
+function scopeOpts(opts: SecretsScopeOpts): {
+  personal: boolean;
+  companySlug: string | undefined;
+} {
+  if (opts.personal && opts.company) {
+    console.error(
+      chalk.red("Error: --personal cannot be combined with --company."),
+    );
+    process.exit(1);
+  }
+  return { personal: !!opts.personal, companySlug: opts.company };
+}
+
+function rejectIfPersonal(opts: SecretsScopeOpts, action: string): void {
+  if (opts.personal) {
+    console.error(
+      chalk.red(`Error: ${action} is not supported with --personal.`),
+    );
+    process.exit(1);
+  }
+}
 
 function shellSingleQuote(value: string): string {
   return "'" + value.replace(/'/g, "'\\''") + "'";
@@ -125,7 +156,11 @@ export function registerSecretsCommand(program: Command): void {
   const secrets = program
     .command("secrets")
     .description("Manage secrets in HQ vault (SSM Parameter Store)")
-    .option("--company <slug>", "Company slug (resolves to companyUid)");
+    .option("--company <slug>", "Company slug (resolves to companyUid)")
+    .option(
+      "--personal",
+      "Operate on the caller's personal vault (no sharing)",
+    );
 
   secrets
     .command("set <name>")
@@ -164,8 +199,10 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const res = await vaultApiFetch({
           token,
@@ -200,8 +237,10 @@ export function registerSecretsCommand(program: Command): void {
     .action(async (name: string, opts: { reveal?: boolean }) => {
       try {
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const query: Record<string, string> = {};
         if (opts.reveal) {
@@ -283,8 +322,10 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const query: Record<string, string> = {};
         if (normalizedPrefix) {
@@ -364,8 +405,10 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const res = await vaultApiFetch({
           token,
@@ -427,8 +470,10 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const revealed = await Promise.all(
           keys.map(async (key) => {
@@ -518,8 +563,10 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const revealed = await Promise.all(
           keys.map(async (key) => {
@@ -568,6 +615,8 @@ export function registerSecretsCommand(program: Command): void {
     .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
     .action(async (name: string, opts: { expires: string }) => {
       try {
+        rejectIfPersonal(secrets.opts(), "generate-link");
+
         if (!SECRET_NAME_PATTERN.test(name)) {
           console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
           process.exit(1);
@@ -586,8 +635,10 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const res = await vaultApiFetch({
           token,
@@ -632,6 +683,8 @@ export function registerSecretsCommand(program: Command): void {
     .requiredOption("--permission <level>", "Permission level: read | write | admin")
     .action(async (path: string, opts: { with: string; permission: string }) => {
       try {
+        rejectIfPersonal(secrets.opts(), "share");
+
         if (!SECRET_NAME_PATTERN.test(path)) {
           console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
           process.exit(1);
@@ -651,8 +704,10 @@ export function registerSecretsCommand(program: Command): void {
         const granteeId = opts.with;
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const res = await vaultApiFetch({
           token,
@@ -695,6 +750,8 @@ export function registerSecretsCommand(program: Command): void {
     .requiredOption("--from <principal>", "Email address or group id to remove")
     .action(async (path: string, opts: { from: string }) => {
       try {
+        rejectIfPersonal(secrets.opts(), "unshare");
+
         if (!SECRET_NAME_PATTERN.test(path)) {
           console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
           process.exit(1);
@@ -709,8 +766,10 @@ export function registerSecretsCommand(program: Command): void {
         const granteeId = opts.from;
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const res = await vaultApiFetch({
           token,
@@ -751,14 +810,18 @@ export function registerSecretsCommand(program: Command): void {
     .description("Show the ACL (access control list) for a secret path")
     .action(async (path: string) => {
       try {
+        rejectIfPersonal(secrets.opts(), "acl");
+
         if (!SECRET_NAME_PATTERN.test(path)) {
           console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
           process.exit(1);
         }
 
         const token = await ensureCognitoToken();
-        const companySlug = secrets.opts().company as string | undefined;
-        const companyUid = await getCompanyUid(token, companySlug);
+        const companyUid = await getEntityUid(
+          token,
+          scopeOpts(secrets.opts()),
+        );
 
         const secretPath = path;
         const res = await vaultApiFetch({

package/src/index.ts

@@ -28,6 +28,8 @@ import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerMembersCommand } from "./commands/members.js";
+import { registerFeedbackCommand } from "./commands/feedback.js";
+import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 
 initSentry();
 
@@ -36,7 +38,7 @@ const program = new Command();
 program
   .name("hq")
   .description("HQ management CLI — modules, packages, and cloud sync")
-  .version("5.8.6");
+  .version("5.12.0");
 
 // Module management subcommand group
 const modulesCmd = program
@@ -109,8 +111,16 @@ registerMembersCommand(program);
 // Onboarding (top-level — Cognito + vault-service provisioning)
 registerOnboardCommand(program);
 
+// Feedback (subcommand group — hq feedback bug|feature)
+registerFeedbackCommand(program);
+
 (async () => {
   try {
+    Sentry.addBreadcrumb({
+      category: "command",
+      message: sanitizeArgv(process.argv.slice(2)).join(" "),
+      level: "info",
+    });
     await program.parseAsync();
   } catch (err) {
     Sentry.captureException(err);

package/src/sentry.ts

@@ -1,6 +1,7 @@
 import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
+import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
 
 export function initSentry(): void {
   const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
@@ -13,6 +14,7 @@ export function initSentry(): void {
       tags: { repo: "hq-cli" },
     },
     beforeSend,
+    beforeBreadcrumb,
   });
 }
 

package/src/utils/breadcrumb-buffer.ts

@@ -0,0 +1,18 @@
+import type { Breadcrumb } from "@sentry/node";
+
+const BUFFER_SIZE = 20;
+const _buffer: Breadcrumb[] = [];
+
+// Sentry beforeBreadcrumb hook: records every breadcrumb in a ring buffer
+// and returns it unchanged so Sentry still processes it normally.
+export function beforeBreadcrumb(breadcrumb: Breadcrumb): Breadcrumb | null {
+  _buffer.push(breadcrumb);
+  if (_buffer.length > BUFFER_SIZE) {
+    _buffer.shift();
+  }
+  return breadcrumb;
+}
+
+export function getRecentBreadcrumbs(): Breadcrumb[] {
+  return [..._buffer];
+}

package/src/utils/feedback-diagnostics.test.ts

@@ -0,0 +1,172 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as os from "os";
+
+vi.mock("child_process", () => ({
+  execFileSync: vi.fn(),
+}));
+
+vi.mock("./breadcrumb-buffer.js", () => ({
+  getRecentBreadcrumbs: vi.fn(() => []),
+}));
+
+import { execFileSync } from "child_process";
+import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
+import { collectDiagnostics, sanitizeArgv } from "./feedback-diagnostics.js";
+import { CLI_VERSION } from "../cli-version.js";
+
+function mockGitSuccess(remoteUrl = "https://github.com/acme/repo.git"): void {
+  vi.mocked(execFileSync).mockImplementation(
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (_cmd: string, args?: any): any => {
+      const a: string[] = args ?? [];
+      if (a[0] === "rev-parse" && a[1] === "--abbrev-ref") return "main\n";
+      if (a[0] === "rev-parse" && a[1] === "--short") return "abc1234\n";
+      if (a[0] === "status") return "";
+      if (a[0] === "remote") return `${remoteUrl}\n`;
+      return "";
+    },
+  );
+}
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  vi.mocked(getRecentBreadcrumbs).mockReturnValue([]);
+  mockGitSuccess();
+});
+
+describe("sanitizeArgv", () => {
+  it("passes through non-secret args unchanged", () => {
+    expect(sanitizeArgv(["feedback", "bug", "--title", "test"])).toEqual([
+      "feedback",
+      "bug",
+      "--title",
+      "test",
+    ]);
+  });
+
+  it("redacts value following a secret flag", () => {
+    expect(sanitizeArgv(["secrets", "set", "NAME", "--token", "abc123"])).toEqual([
+      "secrets",
+      "set",
+      "NAME",
+      "--token",
+      "***",
+    ]);
+  });
+
+  it("redacts --password and --secret flags", () => {
+    expect(sanitizeArgv(["--password", "hunter2", "--secret", "s3cr3t"])).toEqual([
+      "--password",
+      "***",
+      "--secret",
+      "***",
+    ]);
+  });
+
+  it("does not redact a secret flag at the end with no following value", () => {
+    expect(sanitizeArgv(["--token"])).toEqual(["--token"]);
+  });
+
+  it("redacts value in --flag=value form for secret flags", () => {
+    expect(sanitizeArgv(["--token=abc123", "--password=hunter2"])).toEqual([
+      "--token=***",
+      "--password=***",
+    ]);
+  });
+
+  it("passes non-secret --flag=value forms through unchanged", () => {
+    expect(sanitizeArgv(["--title=foo", "--company=acme"])).toEqual([
+      "--title=foo",
+      "--company=acme",
+    ]);
+  });
+});
+
+describe("collectDiagnostics", () => {
+  it("populates cliVersion from the bundled CLI_VERSION constant (not env var)", () => {
+    const saved = process.env.npm_package_version;
+    delete process.env.npm_package_version;
+    const blob = collectDiagnostics();
+    expect(blob.cliVersion).toBe(CLI_VERSION);
+    if (saved !== undefined) process.env.npm_package_version = saved;
+  });
+
+  it("cliVersion is unaffected by npm_package_version env var", () => {
+    process.env.npm_package_version = "99.99.99";
+    const blob = collectDiagnostics();
+    expect(blob.cliVersion).toBe(CLI_VERSION);
+    delete process.env.npm_package_version;
+  });
+
+  it("sanitizes secret flags in the captured command", () => {
+    const saved = process.argv;
+    process.argv = ["node", "/usr/bin/hq", "secrets", "set", "NAME", "--token", "secret123"];
+    const blob = collectDiagnostics();
+    expect(blob.command).toEqual(["secrets", "set", "NAME", "--token", "***"]);
+    process.argv = saved;
+  });
+
+  it("sanitizes --flag=value secret flags in the captured command", () => {
+    const saved = process.argv;
+    process.argv = ["node", "/usr/bin/hq", "secrets", "set", "NAME", "--token=secretXYZ"];
+    const blob = collectDiagnostics();
+    expect(blob.command).toEqual(["secrets", "set", "NAME", "--token=***"]);
+    process.argv = saved;
+  });
+
+  it("captures command as process.argv slice from index 2", () => {
+    const saved = process.argv;
+    process.argv = ["node", "/usr/bin/hq", "feedback", "bug"];
+    const blob = collectDiagnostics();
+    expect(blob.command).toEqual(["feedback", "bug"]);
+    process.argv = saved;
+  });
+
+  it("populates nodeVersion and os fields from process and os module", () => {
+    const blob = collectDiagnostics();
+    expect(blob.nodeVersion).toBe(process.version);
+    expect(blob.os.platform).toBe(os.platform());
+    expect(blob.os.release).toBe(os.release());
+    expect(blob.os.arch).toBe(os.arch());
+  });
+
+  it("sanitizes credentials embedded in HTTPS remote URLs", () => {
+    mockGitSuccess("https://user:s3cr3t@github.com/acme/repo.git");
+    const blob = collectDiagnostics();
+    expect(blob.git.remoteUrl).toBe("https://***@github.com/acme/repo.git");
+  });
+
+  it("returns null git context when not inside a git repo", () => {
+    vi.mocked(execFileSync).mockImplementation(() => {
+      throw new Error("not a git repo");
+    });
+    const blob = collectDiagnostics();
+    expect(blob.git.branch).toBeNull();
+    expect(blob.git.head).toBeNull();
+    expect(blob.git.remoteUrl).toBeNull();
+    expect(blob.git.dirty).toBe(false);
+  });
+
+  it("includes recentSentryBreadcrumbs from the ring buffer", () => {
+    const crumb = { category: "http", message: "GET /v1/foo", level: "info" as const };
+    vi.mocked(getRecentBreadcrumbs).mockReturnValue([crumb]);
+    const blob = collectDiagnostics();
+    expect(blob.recentSentryBreadcrumbs).toEqual([crumb]);
+  });
+
+  it("reports dirty=true when git status shows uncommitted changes", () => {
+    vi.mocked(execFileSync).mockImplementation(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (_cmd: string, args?: any): any => {
+        const a: string[] = args ?? [];
+        if (a[0] === "rev-parse" && a[1] === "--abbrev-ref") return "main\n";
+        if (a[0] === "rev-parse" && a[1] === "--short") return "abc1234\n";
+        if (a[0] === "status") return " M src/index.ts\n";
+        if (a[0] === "remote") return "https://github.com/acme/repo.git\n";
+        return "";
+      },
+    );
+    const blob = collectDiagnostics();
+    expect(blob.git.dirty).toBe(true);
+  });
+});

package/src/utils/feedback-diagnostics.ts

@@ -0,0 +1,115 @@
+import * as os from "os";
+import { execFileSync } from "child_process";
+import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
+import { CLI_VERSION } from "../cli-version.js";
+
+export interface GitContext {
+  branch: string | null;
+  head: string | null;
+  dirty: boolean;
+  remoteUrl: string | null;
+}
+
+export interface DiagnosticsBlob {
+  cliVersion: string;
+  nodeVersion: string;
+  os: { platform: string; release: string; arch: string };
+  command: string[];
+  cwd: string;
+  git: GitContext;
+  recentSentryBreadcrumbs: unknown[];
+}
+
+const SECRET_FLAGS = new Set([
+  "--token",
+  "--secret",
+  "--password",
+  "--key",
+  "--api-key",
+  "--access-token",
+  "--auth-token",
+]);
+
+export function sanitizeArgv(argv: string[]): string[] {
+  const result: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg.startsWith("--") && arg.includes("=")) {
+      const eqIdx = arg.indexOf("=");
+      const flag = arg.slice(0, eqIdx);
+      if (SECRET_FLAGS.has(flag)) {
+        result.push(`${flag}=***`);
+        continue;
+      }
+    }
+    result.push(arg);
+    if (SECRET_FLAGS.has(arg) && i + 1 < argv.length) {
+      result.push("***");
+      i++;
+    }
+  }
+  return result;
+}
+
+function sanitizeRemoteUrl(url: string): string {
+  return url.replace(/https?:\/\/[^@]+@/, "https://***@");
+}
+
+function runGit(args: string[]): string {
+  return execFileSync("git", args, {
+    encoding: "utf-8",
+    timeout: 2000,
+    stdio: ["ignore", "pipe", "ignore"],
+  }).trim();
+}
+
+function collectGitContext(): GitContext {
+  let branch: string | null = null;
+  let head: string | null = null;
+  let dirty = false;
+  let remoteUrl: string | null = null;
+
+  try {
+    branch = runGit(["rev-parse", "--abbrev-ref", "HEAD"]);
+  } catch {
+    return { branch: null, head: null, dirty: false, remoteUrl: null };
+  }
+
+  try {
+    head = runGit(["rev-parse", "--short", "HEAD"]);
+  } catch {
+    // best-effort
+  }
+
+  try {
+    const statusOut = runGit(["status", "--porcelain"]);
+    dirty = statusOut.length > 0;
+  } catch {
+    // best-effort
+  }
+
+  try {
+    const raw = runGit(["remote", "get-url", "origin"]);
+    remoteUrl = sanitizeRemoteUrl(raw);
+  } catch {
+    // no origin remote
+  }
+
+  return { branch, head, dirty, remoteUrl };
+}
+
+export function collectDiagnostics(): DiagnosticsBlob {
+  return {
+    cliVersion: CLI_VERSION,
+    nodeVersion: process.version,
+    os: {
+      platform: os.platform(),
+      release: os.release(),
+      arch: os.arch(),
+    },
+    command: sanitizeArgv(process.argv.slice(2)),
+    cwd: process.cwd(),
+    git: collectGitContext(),
+    recentSentryBreadcrumbs: getRecentBreadcrumbs(),
+  };
+}