@indigoai-us/hq-cli 5.106.2 → 5.107.0

package/dist/utils/hook-trust.js

@@ -3,6 +3,26 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import * as readline from 'node:readline';
+// `~/.claude.json` is Claude Code's live user-global state file, so the write
+// reuses the hardened MCP-registration primitives (advisory lock held across
+// read->merge->write, backup before the first byte, temp+fsync+rename commit)
+// rather than a bare readFile/writeFile pair.
+import { acquireLock, atomicReplace, backupConfig, realpathOrSelf, releaseLock, restoreFromBackup, } from '../commands/mcp-registration.js';
+/**
+ * The home directory every runtime's config is resolved under.
+ *
+ * `HOME=''` is not the same as `HOME` unset: with `??` an empty-but-set `HOME`
+ * survives the fallback, and every `path.join(home, ...)` below it silently
+ * becomes a RELATIVE path — pointing `~/.claude.json` at a same-named file in
+ * the cwd, reading it, writing it, and dropping a backup beside it, while the
+ * user's real config goes untouched. Empty means "no home", exactly as the
+ * safe-write substrate's `resolveEnv` treats it.
+ *
+ * Exported for tests; production callers get it through `DEFAULT_DEPS`.
+ */
+export function defaultHomeDir() {
+    return process.env.HOME?.trim() ? process.env.HOME : os.homedir();
+}
 const CODEX_REQUEST_TIMEOUT_MS = 10_000;
 function errorMessage(value) {
     return value instanceof Error ? value.message : String(value);
@@ -154,7 +174,7 @@ export async function createCodexAppServerClient(cwd, executable = 'codex', args
 }
 const DEFAULT_DEPS = {
     createCodexClient: createCodexAppServerClient,
-    homeDir: () => process.env.HOME ?? os.homedir(),
+    homeDir: defaultHomeDir,
 };
 /** Trust only hooks declared by this HQ root's project `.codex/` layer. */
 export async function trustCodexProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
@@ -232,6 +252,221 @@ export async function trustCodexProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
         }
     }
 }
+/**
+ * How many times to re-read and re-merge `~/.claude.json` when Claude rewrites
+ * it mid-flight. Three is enough to ride out an exiting session's write without
+ * spinning against a runtime that is actively churning the file.
+ */
+const CLAUDE_MERGE_ATTEMPTS = 3;
+/** `~/.claude.json` — Claude Code's user-global state file. */
+function claudeConfigPath(home) {
+    return path.join(home, '.claude.json');
+}
+/**
+ * The home directory to resolve runtime config under, or `''` if there is none.
+ *
+ * An injected `homeDir` is authoritative: if a caller says the home is empty we
+ * report that rather than quietly reaching for the real one behind its back.
+ * The empty-`HOME` fallback lives in {@link defaultHomeDir}.
+ */
+function resolveTrustHome(deps) {
+    const home = (deps.homeDir ?? DEFAULT_DEPS.homeDir)();
+    return home?.trim() ? home : '';
+}
+/**
+ * Every spelling of the HQ root that Claude might have keyed `projects` under.
+ *
+ * Claude keys a project by the cwd of the session, so a symlinked HQ root can
+ * appear under either the link or its target depending on how the user got
+ * there. Trusting both is harmless — an entry for a path is inert until a
+ * session actually opens it — and trusting only one is a silent no-op.
+ *
+ * `aliases` carries the spellings the caller had before it canonicalized;
+ * without them a command that realpaths its root up front can only ever
+ * produce one key here, and the symlink branch is unreachable in real use.
+ */
+function claudeProjectKeys(hqRoot, aliases = []) {
+    const keys = [];
+    const add = (candidate) => {
+        if (candidate && !keys.includes(candidate))
+            keys.push(candidate);
+    };
+    for (const raw of [hqRoot, ...aliases]) {
+        if (!raw)
+            continue;
+        const resolved = path.resolve(raw);
+        add(resolved);
+        try {
+            add(fs.realpathSync(resolved));
+        }
+        catch {
+            // Root may be unreadable; the literal path is still worth trusting.
+        }
+    }
+    return keys;
+}
+/** Re-read from disk and report which keys are still not trusted. */
+function pendingAfterWrite(target, keys) {
+    let projects;
+    try {
+        projects = asObject(asObject(JSON.parse(fs.readFileSync(target, 'utf8')))?.projects);
+    }
+    catch {
+        return [...keys];
+    }
+    return keys.filter((key) => asObject(projects?.[key])?.hasTrustDialogAccepted !== true);
+}
+/**
+ * Mark this HQ root as a trusted Claude Code workspace.
+ *
+ * WHY reindex owns this: Claude's trust is per FOLDER, not per hook — the same
+ * flag gates project `.claude/settings.json` hooks AND the `.claude/skills/`
+ * plugin scan. An untrusted HQ root loads neither, and Claude reports it as
+ * "skipped because this workspace was not trusted when plugins were scanned".
+ * So the Claude leg looks like the Grok leg (write folder trust into the
+ * runtime's own config) rather than the Codex leg (trust individual hooks).
+ *
+ * Setting the key is the runtime's own documented alternative to the dialog;
+ * Claude Code's error text names it directly: "Run Claude Code in that folder
+ * once and accept the trust dialog, or set
+ * projects[<path>].hasTrustDialogAccepted: true".
+ *
+ * `~/.claude.json` is a live, high-traffic file — Claude rewrites it after
+ * every session — so this reuses the MCP registration machinery rather than a
+ * bare read/write: the advisory lock is held across read->merge->write, a
+ * backup is taken before the first written byte, and the commit is a
+ * temp+fsync+rename. `JSON.stringify(doc, null, 2)` reproduces Claude's own
+ * formatting byte-for-byte, so an unrelated key is never reformatted.
+ */
+export function trustClaudeProjectFolder(hqRoot, deps = DEFAULT_DEPS, options = {}) {
+    const home = resolveTrustHome(deps);
+    if (!home) {
+        return {
+            runtime: 'claude',
+            status: 'failed',
+            trusted: 0,
+            reason: 'cannot resolve a home directory for ~/.claude.json (HOME is empty and os.homedir() gave nothing)',
+        };
+    }
+    const target = claudeConfigPath(home);
+    if (!fs.existsSync(target)) {
+        return {
+            runtime: 'claude',
+            status: 'skipped',
+            trusted: 0,
+            reason: 'Claude Code has not run on this machine (~/.claude.json absent)',
+        };
+    }
+    const keys = claudeProjectKeys(hqRoot, options.rootAliases);
+    const fail = (reason) => ({
+        runtime: 'claude',
+        status: 'failed',
+        trusted: 0,
+        reason,
+    });
+    let lock;
+    try {
+        try {
+            lock = acquireLock(target, options.lockWaitMs === undefined ? {} : { waitMs: options.lockWaitMs });
+        }
+        catch (error) {
+            // Contention is not corruption. Another HQ writer holds the file, the
+            // next reindex converges, and a lifecycle hook must not stall behind it.
+            return {
+                runtime: 'claude',
+                status: 'skipped',
+                trusted: 0,
+                reason: `another HQ process is writing ~/.claude.json (${errorMessage(error)})`,
+            };
+        }
+        // Read and write the symlink TARGET, never the link. `atomicReplace` takes
+        // a *realTarget* — handed a link it renames a regular file over the link,
+        // silently detaching it and leaving the real config unchanged (and the
+        // read-back verification would still pass, against the wrong file).
+        const real = realpathOrSelf(target);
+        const readText = deps.readConfigText ?? ((file) => fs.readFileSync(file, 'utf8'));
+        for (let attempt = 1; attempt <= CLAUDE_MERGE_ATTEMPTS; attempt += 1) {
+            const raw = readText(real);
+            let doc;
+            try {
+                doc = JSON.parse(raw);
+            }
+            catch (error) {
+                // Never rewrite a file we could not parse — that would replace the
+                // user's Claude state with our own idea of it.
+                return fail(`~/.claude.json is not valid JSON (${errorMessage(error)})`);
+            }
+            const config = asObject(doc);
+            if (!config)
+                return fail('~/.claude.json is not a JSON object');
+            const projectsValue = config.projects === undefined ? {} : config.projects;
+            const projects = asObject(projectsValue);
+            if (!projects)
+                return fail('~/.claude.json "projects" is not an object');
+            // A PRESENT entry that is not an object (null, an array, a scalar) is
+            // either corruption or a schema we do not understand. Spreading it away
+            // would irreversibly drop live per-project state, so refuse instead —
+            // the same conservatism applied to the document as a whole.
+            const malformed = keys.filter((key) => projects[key] !== undefined && !asObject(projects[key]));
+            if (malformed.length > 0) {
+                return fail(`~/.claude.json has a non-object "projects" entry for ${malformed.join(', ')}`);
+            }
+            const pending = keys.filter((key) => asObject(projects[key])?.hasTrustDialogAccepted !== true);
+            if (pending.length === 0) {
+                return { runtime: 'claude', status: 'unchanged', trusted: 0 };
+            }
+            for (const key of pending) {
+                // Preserve every other field Claude keeps per project (lastCost,
+                // lastSessionId, exampleFiles, …) — only the trust flag is ours.
+                projects[key] = { ...(asObject(projects[key]) ?? {}), hasTrustDialogAccepted: true };
+            }
+            config.projects = projects;
+            const next = JSON.stringify(config, null, 2);
+            // Compare-and-swap against CLAUDE ITSELF. `.hqlock` only serializes HQ
+            // code that calls `acquireLock`; Claude has never heard of it and
+            // rewrites this file after every session. If the bytes moved under us
+            // since the read, our merge is built on a stale document and committing
+            // it would silently discard whatever Claude just wrote — so re-read and
+            // re-merge instead. This narrows the exposure to the gap between this
+            // check and the rename; it cannot close it, and losing the race is
+            // reported rather than papered over.
+            if (readText(real) !== raw) {
+                if (attempt < CLAUDE_MERGE_ATTEMPTS)
+                    continue;
+                return fail('Claude rewrote ~/.claude.json during each merge attempt; left it alone rather than discarding its concurrent write');
+            }
+            // Backup before the first written byte: this is the user's live Claude
+            // state, and the backup is the only remediation if the write goes wrong.
+            const backupDir = backupConfig({ home }, target, 'hq-hook-trust');
+            atomicReplace(real, next);
+            // Verify from disk rather than trusting the in-memory merge, and roll the
+            // file back if the flag did not land — a half-written Claude state file is
+            // worse than an untrusted folder.
+            const stillPending = pendingAfterWrite(real, keys);
+            if (stillPending.length > 0) {
+                let tail = `restored from backup ${backupDir}`;
+                try {
+                    restoreFromBackup(real, backupDir);
+                }
+                catch {
+                    tail = `RESTORE FAILED — the original is recoverable at ${backupDir}`;
+                }
+                return fail(`trust flag did not persist for ${stillPending.join(', ')}; ${tail}`);
+            }
+            return { runtime: 'claude', status: 'trusted', trusted: pending.length };
+        }
+        /* c8 ignore next -- the loop returns or continues; continue past the last
+           attempt is guarded above. */
+        return fail('exhausted ~/.claude.json merge attempts');
+    }
+    catch (error) {
+        return fail(errorMessage(error));
+    }
+    finally {
+        if (lock)
+            releaseLock(lock);
+    }
+}
 function regexEscape(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -412,19 +647,23 @@ export function trustGrokProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
     }
 }
 /** Converge hook trust without turning an absent runtime into a reindex failure. */
-export async function trustHqRuntimeHooks(hqRoot, deps = DEFAULT_DEPS) {
+export async function trustHqRuntimeHooks(hqRoot, deps = DEFAULT_DEPS, options = {}) {
     const results = [
         await trustCodexProjectHooks(hqRoot, deps),
         trustGrokProjectHooks(hqRoot, deps),
+        trustClaudeProjectFolder(hqRoot, deps, options),
     ];
     for (const result of results) {
         if (result.status === 'trusted') {
             if (result.runtime === 'codex') {
                 console.log(`reindex: trusted ${result.trusted} Codex HQ hook${result.trusted === 1 ? '' : 's'}`);
             }
-            else {
+            else if (result.runtime === 'grok') {
                 console.log('reindex: refreshed Grok HQ hook trust');
             }
+            else {
+                console.log('reindex: trusted this HQ folder for Claude Code hooks and skills');
+            }
         }
         else if (result.status === 'failed') {
             console.warn(`reindex: could not trust ${result.runtime} HQ hooks: ${result.reason ?? 'unknown error'}`);

package/dist/utils/vault-api.js

@@ -1,4 +1,5 @@
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
+import { CLI_VERSION } from '../cli-version.js';
 import { Sentry } from '../sentry.js';
 import { AuthError } from './auth-error.js';
 import { CompanySelectionError } from './company-selection-error.js';
@@ -169,6 +170,11 @@ export async function vaultApiFetch(opts) {
                 Authorization: `Bearer ${opts.token}`,
                 'Content-Type': 'application/json',
                 'x-hq-client-name': HQ_CLIENT_NAME,
+                // US-003: version alongside the client family, mirroring the desktop
+                // app's client_info.rs headers, so the server can see client-version
+                // skew on EVERY authenticated request, not only health heartbeats.
+                // Fixed build constant, never caller-supplied; attribution only.
+                'x-hq-client-version': CLI_VERSION,
             },
             body: opts.body ? JSON.stringify(opts.body) : undefined,
             signal: opts.signal,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.106.2",
+  "version": "5.107.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -30,7 +30,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "~6.16.3",
+    "@indigoai-us/hq-cloud": "~6.16.6",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "@tobilu/qmd": "2.5.3",