@indigoai-us/hq-cli 5.11.0 → 5.12.0

package/src/utils/feedback-diagnostics.test.ts

@@ -0,0 +1,172 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as os from "os";
+
+vi.mock("child_process", () => ({
+  execFileSync: vi.fn(),
+}));
+
+vi.mock("./breadcrumb-buffer.js", () => ({
+  getRecentBreadcrumbs: vi.fn(() => []),
+}));
+
+import { execFileSync } from "child_process";
+import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
+import { collectDiagnostics, sanitizeArgv } from "./feedback-diagnostics.js";
+import { CLI_VERSION } from "../cli-version.js";
+
+function mockGitSuccess(remoteUrl = "https://github.com/acme/repo.git"): void {
+  vi.mocked(execFileSync).mockImplementation(
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (_cmd: string, args?: any): any => {
+      const a: string[] = args ?? [];
+      if (a[0] === "rev-parse" && a[1] === "--abbrev-ref") return "main\n";
+      if (a[0] === "rev-parse" && a[1] === "--short") return "abc1234\n";
+      if (a[0] === "status") return "";
+      if (a[0] === "remote") return `${remoteUrl}\n`;
+      return "";
+    },
+  );
+}
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  vi.mocked(getRecentBreadcrumbs).mockReturnValue([]);
+  mockGitSuccess();
+});
+
+describe("sanitizeArgv", () => {
+  it("passes through non-secret args unchanged", () => {
+    expect(sanitizeArgv(["feedback", "bug", "--title", "test"])).toEqual([
+      "feedback",
+      "bug",
+      "--title",
+      "test",
+    ]);
+  });
+
+  it("redacts value following a secret flag", () => {
+    expect(sanitizeArgv(["secrets", "set", "NAME", "--token", "abc123"])).toEqual([
+      "secrets",
+      "set",
+      "NAME",
+      "--token",
+      "***",
+    ]);
+  });
+
+  it("redacts --password and --secret flags", () => {
+    expect(sanitizeArgv(["--password", "hunter2", "--secret", "s3cr3t"])).toEqual([
+      "--password",
+      "***",
+      "--secret",
+      "***",
+    ]);
+  });
+
+  it("does not redact a secret flag at the end with no following value", () => {
+    expect(sanitizeArgv(["--token"])).toEqual(["--token"]);
+  });
+
+  it("redacts value in --flag=value form for secret flags", () => {
+    expect(sanitizeArgv(["--token=abc123", "--password=hunter2"])).toEqual([
+      "--token=***",
+      "--password=***",
+    ]);
+  });
+
+  it("passes non-secret --flag=value forms through unchanged", () => {
+    expect(sanitizeArgv(["--title=foo", "--company=acme"])).toEqual([
+      "--title=foo",
+      "--company=acme",
+    ]);
+  });
+});
+
+describe("collectDiagnostics", () => {
+  it("populates cliVersion from the bundled CLI_VERSION constant (not env var)", () => {
+    const saved = process.env.npm_package_version;
+    delete process.env.npm_package_version;
+    const blob = collectDiagnostics();
+    expect(blob.cliVersion).toBe(CLI_VERSION);
+    if (saved !== undefined) process.env.npm_package_version = saved;
+  });
+
+  it("cliVersion is unaffected by npm_package_version env var", () => {
+    process.env.npm_package_version = "99.99.99";
+    const blob = collectDiagnostics();
+    expect(blob.cliVersion).toBe(CLI_VERSION);
+    delete process.env.npm_package_version;
+  });
+
+  it("sanitizes secret flags in the captured command", () => {
+    const saved = process.argv;
+    process.argv = ["node", "/usr/bin/hq", "secrets", "set", "NAME", "--token", "secret123"];
+    const blob = collectDiagnostics();
+    expect(blob.command).toEqual(["secrets", "set", "NAME", "--token", "***"]);
+    process.argv = saved;
+  });
+
+  it("sanitizes --flag=value secret flags in the captured command", () => {
+    const saved = process.argv;
+    process.argv = ["node", "/usr/bin/hq", "secrets", "set", "NAME", "--token=secretXYZ"];
+    const blob = collectDiagnostics();
+    expect(blob.command).toEqual(["secrets", "set", "NAME", "--token=***"]);
+    process.argv = saved;
+  });
+
+  it("captures command as process.argv slice from index 2", () => {
+    const saved = process.argv;
+    process.argv = ["node", "/usr/bin/hq", "feedback", "bug"];
+    const blob = collectDiagnostics();
+    expect(blob.command).toEqual(["feedback", "bug"]);
+    process.argv = saved;
+  });
+
+  it("populates nodeVersion and os fields from process and os module", () => {
+    const blob = collectDiagnostics();
+    expect(blob.nodeVersion).toBe(process.version);
+    expect(blob.os.platform).toBe(os.platform());
+    expect(blob.os.release).toBe(os.release());
+    expect(blob.os.arch).toBe(os.arch());
+  });
+
+  it("sanitizes credentials embedded in HTTPS remote URLs", () => {
+    mockGitSuccess("https://user:s3cr3t@github.com/acme/repo.git");
+    const blob = collectDiagnostics();
+    expect(blob.git.remoteUrl).toBe("https://***@github.com/acme/repo.git");
+  });
+
+  it("returns null git context when not inside a git repo", () => {
+    vi.mocked(execFileSync).mockImplementation(() => {
+      throw new Error("not a git repo");
+    });
+    const blob = collectDiagnostics();
+    expect(blob.git.branch).toBeNull();
+    expect(blob.git.head).toBeNull();
+    expect(blob.git.remoteUrl).toBeNull();
+    expect(blob.git.dirty).toBe(false);
+  });
+
+  it("includes recentSentryBreadcrumbs from the ring buffer", () => {
+    const crumb = { category: "http", message: "GET /v1/foo", level: "info" as const };
+    vi.mocked(getRecentBreadcrumbs).mockReturnValue([crumb]);
+    const blob = collectDiagnostics();
+    expect(blob.recentSentryBreadcrumbs).toEqual([crumb]);
+  });
+
+  it("reports dirty=true when git status shows uncommitted changes", () => {
+    vi.mocked(execFileSync).mockImplementation(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (_cmd: string, args?: any): any => {
+        const a: string[] = args ?? [];
+        if (a[0] === "rev-parse" && a[1] === "--abbrev-ref") return "main\n";
+        if (a[0] === "rev-parse" && a[1] === "--short") return "abc1234\n";
+        if (a[0] === "status") return " M src/index.ts\n";
+        if (a[0] === "remote") return "https://github.com/acme/repo.git\n";
+        return "";
+      },
+    );
+    const blob = collectDiagnostics();
+    expect(blob.git.dirty).toBe(true);
+  });
+});

package/src/utils/feedback-diagnostics.ts

@@ -0,0 +1,115 @@
+import * as os from "os";
+import { execFileSync } from "child_process";
+import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
+import { CLI_VERSION } from "../cli-version.js";
+
+export interface GitContext {
+  branch: string | null;
+  head: string | null;
+  dirty: boolean;
+  remoteUrl: string | null;
+}
+
+export interface DiagnosticsBlob {
+  cliVersion: string;
+  nodeVersion: string;
+  os: { platform: string; release: string; arch: string };
+  command: string[];
+  cwd: string;
+  git: GitContext;
+  recentSentryBreadcrumbs: unknown[];
+}
+
+const SECRET_FLAGS = new Set([
+  "--token",
+  "--secret",
+  "--password",
+  "--key",
+  "--api-key",
+  "--access-token",
+  "--auth-token",
+]);
+
+export function sanitizeArgv(argv: string[]): string[] {
+  const result: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg.startsWith("--") && arg.includes("=")) {
+      const eqIdx = arg.indexOf("=");
+      const flag = arg.slice(0, eqIdx);
+      if (SECRET_FLAGS.has(flag)) {
+        result.push(`${flag}=***`);
+        continue;
+      }
+    }
+    result.push(arg);
+    if (SECRET_FLAGS.has(arg) && i + 1 < argv.length) {
+      result.push("***");
+      i++;
+    }
+  }
+  return result;
+}
+
+function sanitizeRemoteUrl(url: string): string {
+  return url.replace(/https?:\/\/[^@]+@/, "https://***@");
+}
+
+function runGit(args: string[]): string {
+  return execFileSync("git", args, {
+    encoding: "utf-8",
+    timeout: 2000,
+    stdio: ["ignore", "pipe", "ignore"],
+  }).trim();
+}
+
+function collectGitContext(): GitContext {
+  let branch: string | null = null;
+  let head: string | null = null;
+  let dirty = false;
+  let remoteUrl: string | null = null;
+
+  try {
+    branch = runGit(["rev-parse", "--abbrev-ref", "HEAD"]);
+  } catch {
+    return { branch: null, head: null, dirty: false, remoteUrl: null };
+  }
+
+  try {
+    head = runGit(["rev-parse", "--short", "HEAD"]);
+  } catch {
+    // best-effort
+  }
+
+  try {
+    const statusOut = runGit(["status", "--porcelain"]);
+    dirty = statusOut.length > 0;
+  } catch {
+    // best-effort
+  }
+
+  try {
+    const raw = runGit(["remote", "get-url", "origin"]);
+    remoteUrl = sanitizeRemoteUrl(raw);
+  } catch {
+    // no origin remote
+  }
+
+  return { branch, head, dirty, remoteUrl };
+}
+
+export function collectDiagnostics(): DiagnosticsBlob {
+  return {
+    cliVersion: CLI_VERSION,
+    nodeVersion: process.version,
+    os: {
+      platform: os.platform(),
+      release: os.release(),
+      arch: os.arch(),
+    },
+    command: sanitizeArgv(process.argv.slice(2)),
+    cwd: process.cwd(),
+    git: collectGitContext(),
+    recentSentryBreadcrumbs: getRecentBreadcrumbs(),
+  };
+}

package/src/utils/vault-api.test.ts

@@ -1,6 +1,11 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 
-import { getEntityUid, resolveCallerPersonUid } from './vault-api.js';
+vi.mock('../sentry.js', () => ({
+  Sentry: { addBreadcrumb: vi.fn() },
+}));
+
+import { Sentry } from '../sentry.js';
+import { getEntityUid, resolveCallerPersonUid, vaultApiFetch } from './vault-api.js';
 
 const fetchMock = vi.fn();
 const originalFetch = globalThis.fetch;
@@ -109,3 +114,34 @@ describe('getEntityUid', () => {
     expect(url).toMatch(/\/membership\/me/);
   });
 });
+
+describe('vaultApiFetch breadcrumb URL sanitization', () => {
+  it('redacts query string in request breadcrumb data.url', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(200, {}));
+    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
+    addBreadcrumbMock.mockClear();
+    await vaultApiFetch({ token: 'tok', path: '/v1/foo', query: { path: 'secrets/my-secret', reveal: 'true' } });
+    const requestCrumb = addBreadcrumbMock.mock.calls[0][0];
+    expect(requestCrumb.data?.url).not.toMatch(/secrets%2F|reveal=true/);
+    expect(requestCrumb.data?.url).toContain('?<redacted>');
+  });
+
+  it('omits query delimiter when there is no query string', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(200, {}));
+    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
+    addBreadcrumbMock.mockClear();
+    await vaultApiFetch({ token: 'tok', path: '/v1/bar' });
+    const requestCrumb = addBreadcrumbMock.mock.calls[0][0];
+    expect(requestCrumb.data?.url).not.toContain('?');
+  });
+
+  it('redacts query string in non-2xx error breadcrumb data.url', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(401, {}));
+    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
+    addBreadcrumbMock.mockClear();
+    await vaultApiFetch({ token: 'tok', path: '/v1/baz', query: { action: 'generate-token' } });
+    const errorCrumb = addBreadcrumbMock.mock.calls[1][0];
+    expect(errorCrumb.data?.url).not.toContain('generate-token');
+    expect(errorCrumb.data?.url).toContain('?<redacted>');
+  });
+});

package/src/utils/vault-api.ts

@@ -1,4 +1,5 @@
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
+import { Sentry } from '../sentry.js';
 
 export interface VaultApiOptions {
   token: string;
@@ -15,14 +16,31 @@ export async function vaultApiFetch(opts: VaultApiOptions): Promise<Response> {
       url.searchParams.set(k, v);
     }
   }
-  return fetch(url.toString(), {
-    method: opts.method ?? 'GET',
+  const method = opts.method ?? 'GET';
+  const safeUrl = url.search ? `${url.origin}${url.pathname}?<redacted>` : `${url.origin}${url.pathname}`;
+  Sentry.addBreadcrumb({
+    category: "http",
+    message: `${method} ${opts.path}`,
+    level: "info",
+    data: { url: safeUrl, method },
+  });
+  const response = await fetch(url.toString(), {
+    method,
     headers: {
       Authorization: `Bearer ${opts.token}`,
       'Content-Type': 'application/json',
     },
     body: opts.body ? JSON.stringify(opts.body) : undefined,
   });
+  if (!response.ok) {
+    Sentry.addBreadcrumb({
+      category: "http",
+      message: `${method} ${opts.path} → ${response.status}`,
+      level: "warning",
+      data: { url: safeUrl, status: response.status },
+    });
+  }
+  return response;
 }
 
 interface MembershipEntry {