@indigoai-us/hq-cli 5.11.0 → 5.12.1

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## [5.12.1] — 2026-05-09
+
+### Fixed
+
+- **CREATED BY column in HQ Console Vault now populates for cloud-synced files.**
+  Pulls in `@indigoai-us/hq-cloud@5.11.3`, which stamps `created-by`,
+  `created-by-sub`, and `created-at` user metadata on every `PutObject` so the
+  vault listing's HEAD fan-out has identity to attribute. Files synced via
+  `hq cloud provision`, `hq files share`, and the watcher previously rendered
+  as `—` because only the Next.js upload route stamped author metadata.
+
+## [5.12.0] — 2026-05-08
+
+### Added
+
+- **`hq feedback` command group** — two subcommands `hq feedback bug` and
+  `hq feedback feature` let any logged-in user submit structured feedback without
+  leaving the terminal. Submissions are JWT-authenticated via the existing Cognito
+  session (no additional login step).
+
+- **`--body-file <path>` flag** — pass a pre-written markdown file as the feedback
+  body. Multi-line input without shell quoting headaches. Use `--body-file -` to read
+  from stdin (useful for piped workflows). Body input is file-based by design (no
+  inline string flag).
+
+- **`--company <slug>` flag (optional)** — attaches a company context to the submission.
+  Resolved automatically from `core/scripts/hq-session.sh get company_slug` inside the
+  `/feedback` skill; the flag is omitted when the slug is empty.
+
+- **Diagnostics blob** — every submission includes a structured diagnostics payload
+  (`cliVersion`, `nodeVersion`, `os.platform`, `os.release`, `command` argv array,
+  `cwd`, `recentSentryBreadcrumbs`). Purely plain CLI/process context — no GHQ-OS-aware
+  identifiers.
+
+- **Slack relay** — the vault-service backend best-effort posts a formatted card to
+  `#hq-feedback` after writing the DynamoDB row. Relay is fire-and-forget; Slack
+  failures do not affect the HTTP response.
+
+### Example
+
+```bash
+# Interactive: title prompted if not supplied
+hq feedback bug --title "search broken on mobile"
+
+# Scripted: body from a pre-written file
+hq feedback feature --title "dark mode" --body-file /tmp/feature-body.md
+
+# Piped: read body from stdin
+echo "Steps to reproduce: ..." | hq feedback bug --title "crash on login" --body-file -
+```
+
+## [5.11.0] — 2026-05-07
+
+### Added
+
+- **`--personal` flag for `hq secrets`** — pin a secret to the per-user store rather
+  than the company store. See commit `b5ec9bd` ("release: hq-cli@5.11.0 — --personal
+  flag for secrets") for details.
+
 ## [5.10.0] — 2026-05-04
 
 ### Added

package/dist/cli-version.d.ts

@@ -0,0 +1,2 @@
+export declare const CLI_VERSION = "5.12.1";
+//# sourceMappingURL=cli-version.d.ts.map

package/dist/cli-version.js

@@ -0,0 +1,5 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f65738b2-fa67-5b68-a0c8-c73fba12c6c5")}catch(e){}}();
+export const CLI_VERSION = "5.12.1";
+//# sourceMappingURL=cli-version.js.map
+//# debugId=f65738b2-fa67-5b68-a0c8-c73fba12c6c5

package/dist/commands/feedback.d.ts

@@ -0,0 +1,16 @@
+import { Command } from "commander";
+export declare const BODY_MAX_BYTES: number;
+export interface FeedbackResult {
+    id: string;
+}
+export interface FeedbackSubmitOptions {
+    type: "bug" | "feature";
+    title: string;
+    body: string;
+    company?: string;
+    token: string;
+}
+export declare function readBodyFile(bodyFile: string, stdin?: NodeJS.ReadableStream): Promise<string>;
+export declare function submitFeedback(opts: FeedbackSubmitOptions): Promise<FeedbackResult>;
+export declare function registerFeedbackCommand(program: Command): void;
+//# sourceMappingURL=feedback.d.ts.map

package/dist/commands/feedback.js

@@ -0,0 +1,98 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4")}catch(e){}}();
+import * as fs from "node:fs";
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+export const BODY_MAX_BYTES = 64 * 1024;
+export async function readBodyFile(bodyFile, stdin) {
+    if (bodyFile === "-") {
+        const stream = stdin ?? process.stdin;
+        if (stream.isTTY) {
+            throw new Error("--body-file - requires piped stdin (got interactive terminal).");
+        }
+        return new Promise((resolve, reject) => {
+            let data = "";
+            stream.setEncoding("utf8");
+            stream.on("data", (chunk) => {
+                data += chunk;
+            });
+            stream.on("end", () => resolve(data));
+            stream.on("error", reject);
+        });
+    }
+    return fs.promises.readFile(bodyFile, "utf-8");
+}
+export async function submitFeedback(opts) {
+    if (opts.body.trim().length === 0) {
+        throw new Error("body must not be empty. Provide at least one non-whitespace character.");
+    }
+    const bodyBytes = Buffer.byteLength(opts.body, "utf8");
+    if (bodyBytes > BODY_MAX_BYTES) {
+        throw new Error(`Body exceeds 64 KiB limit (${bodyBytes} bytes). Reduce the body size before submitting.`);
+    }
+    const diagnostics = collectDiagnostics();
+    const requestBody = {
+        type: opts.type,
+        title: opts.title,
+        body: opts.body,
+        diagnostics,
+    };
+    if (opts.company) {
+        requestBody.company = opts.company;
+    }
+    const res = await vaultApiFetch({
+        token: opts.token,
+        path: "/v1/feedback",
+        method: "POST",
+        body: requestBody,
+    });
+    if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        const errMsg = data &&
+            typeof data === "object" &&
+            !Array.isArray(data) &&
+            typeof data.error === "string"
+            ? data.error
+            : res.statusText;
+        throw new Error(`Failed to submit feedback: ${errMsg}`);
+    }
+    const data = (await res.json());
+    return { id: data.id };
+}
+function registerSubcommand(feedbackCmd, type) {
+    feedbackCmd
+        .command(type)
+        .description(type === "bug" ? "Report a bug" : "Request a feature")
+        .requiredOption("--title <text>", "Short title for the report")
+        .requiredOption("--body-file <path>", "Path to a markdown file with the body; use - to read from stdin")
+        .option("--company <slug>", "Company slug to associate with the report")
+        .action(async (opts) => {
+        try {
+            const token = await ensureCognitoToken({ interactive: false });
+            const body = await readBodyFile(opts.bodyFile);
+            const result = await submitFeedback({
+                type,
+                title: opts.title,
+                body,
+                company: opts.company,
+                token,
+            });
+            console.log(`Submitted: ${result.id}`);
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+export function registerFeedbackCommand(program) {
+    const feedbackCmd = program
+        .command("feedback")
+        .description("Submit a bug report or feature request to HQ");
+    registerSubcommand(feedbackCmd, "bug");
+    registerSubcommand(feedbackCmd, "feature");
+}
+//# sourceMappingURL=feedback.js.map
+//# debugId=3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e834c407-cd5c-5dc1-af3b-7f041af651ef")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="65033669-3ba8-5aac-8a98-49827f627ff9")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -28,12 +28,14 @@ import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerMembersCommand } from "./commands/members.js";
+import { registerFeedbackCommand } from "./commands/feedback.js";
+import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 initSentry();
 const program = new Command();
 program
     .name("hq")
     .description("HQ management CLI — modules, packages, and cloud sync")
-    .version("5.8.6");
+    .version("5.12.1");
 // Module management subcommand group
 const modulesCmd = program
     .command("modules")
@@ -86,8 +88,15 @@ registerFilesCommand(program);
 registerMembersCommand(program);
 // Onboarding (top-level — Cognito + vault-service provisioning)
 registerOnboardCommand(program);
+// Feedback (subcommand group — hq feedback bug|feature)
+registerFeedbackCommand(program);
 (async () => {
     try {
+        Sentry.addBreadcrumb({
+            category: "command",
+            message: sanitizeArgv(process.argv.slice(2)).join(" "),
+            level: "info",
+        });
         await program.parseAsync();
     }
     catch (err) {
@@ -99,4 +108,4 @@ registerOnboardCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=e834c407-cd5c-5dc1-af3b-7f041af651ef
+//# debugId=65033669-3ba8-5aac-8a98-49827f627ff9

package/dist/sentry.js

@@ -1,8 +1,9 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9a31fb53-8cc1-5394-ac16-e96b82fa6caa")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="508ac88d-5683-5d1f-9857-80a8a74e03e2")}catch(e){}}();
 import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
+import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
 export function initSentry() {
     const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
     if (!dsn)
@@ -15,8 +16,9 @@ export function initSentry() {
             tags: { repo: "hq-cli" },
         },
         beforeSend,
+        beforeBreadcrumb,
     });
 }
 export { Sentry };
 //# sourceMappingURL=sentry.js.map
-//# debugId=9a31fb53-8cc1-5394-ac16-e96b82fa6caa
+//# debugId=508ac88d-5683-5d1f-9857-80a8a74e03e2

package/dist/utils/breadcrumb-buffer.d.ts

@@ -0,0 +1,4 @@
+import type { Breadcrumb } from "@sentry/node";
+export declare function beforeBreadcrumb(breadcrumb: Breadcrumb): Breadcrumb | null;
+export declare function getRecentBreadcrumbs(): Breadcrumb[];
+//# sourceMappingURL=breadcrumb-buffer.d.ts.map

package/dist/utils/breadcrumb-buffer.js

@@ -0,0 +1,18 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6a54e8f0-10de-59c2-82d9-22de94d9e6f2")}catch(e){}}();
+const BUFFER_SIZE = 20;
+const _buffer = [];
+// Sentry beforeBreadcrumb hook: records every breadcrumb in a ring buffer
+// and returns it unchanged so Sentry still processes it normally.
+export function beforeBreadcrumb(breadcrumb) {
+    _buffer.push(breadcrumb);
+    if (_buffer.length > BUFFER_SIZE) {
+        _buffer.shift();
+    }
+    return breadcrumb;
+}
+export function getRecentBreadcrumbs() {
+    return [..._buffer];
+}
+//# sourceMappingURL=breadcrumb-buffer.js.map
+//# debugId=6a54e8f0-10de-59c2-82d9-22de94d9e6f2

package/dist/utils/feedback-diagnostics.d.ts

@@ -0,0 +1,22 @@
+export interface GitContext {
+    branch: string | null;
+    head: string | null;
+    dirty: boolean;
+    remoteUrl: string | null;
+}
+export interface DiagnosticsBlob {
+    cliVersion: string;
+    nodeVersion: string;
+    os: {
+        platform: string;
+        release: string;
+        arch: string;
+    };
+    command: string[];
+    cwd: string;
+    git: GitContext;
+    recentSentryBreadcrumbs: unknown[];
+}
+export declare function sanitizeArgv(argv: string[]): string[];
+export declare function collectDiagnostics(): DiagnosticsBlob;
+//# sourceMappingURL=feedback-diagnostics.d.ts.map

package/dist/utils/feedback-diagnostics.js

@@ -0,0 +1,95 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ee39c63b-ddaa-553d-b5db-77633d323d88")}catch(e){}}();
+import * as os from "os";
+import { execFileSync } from "child_process";
+import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
+import { CLI_VERSION } from "../cli-version.js";
+const SECRET_FLAGS = new Set([
+    "--token",
+    "--secret",
+    "--password",
+    "--key",
+    "--api-key",
+    "--access-token",
+    "--auth-token",
+]);
+export function sanitizeArgv(argv) {
+    const result = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg.startsWith("--") && arg.includes("=")) {
+            const eqIdx = arg.indexOf("=");
+            const flag = arg.slice(0, eqIdx);
+            if (SECRET_FLAGS.has(flag)) {
+                result.push(`${flag}=***`);
+                continue;
+            }
+        }
+        result.push(arg);
+        if (SECRET_FLAGS.has(arg) && i + 1 < argv.length) {
+            result.push("***");
+            i++;
+        }
+    }
+    return result;
+}
+function sanitizeRemoteUrl(url) {
+    return url.replace(/https?:\/\/[^@]+@/, "https://***@");
+}
+function runGit(args) {
+    return execFileSync("git", args, {
+        encoding: "utf-8",
+        timeout: 2000,
+        stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+}
+function collectGitContext() {
+    let branch = null;
+    let head = null;
+    let dirty = false;
+    let remoteUrl = null;
+    try {
+        branch = runGit(["rev-parse", "--abbrev-ref", "HEAD"]);
+    }
+    catch {
+        return { branch: null, head: null, dirty: false, remoteUrl: null };
+    }
+    try {
+        head = runGit(["rev-parse", "--short", "HEAD"]);
+    }
+    catch {
+        // best-effort
+    }
+    try {
+        const statusOut = runGit(["status", "--porcelain"]);
+        dirty = statusOut.length > 0;
+    }
+    catch {
+        // best-effort
+    }
+    try {
+        const raw = runGit(["remote", "get-url", "origin"]);
+        remoteUrl = sanitizeRemoteUrl(raw);
+    }
+    catch {
+        // no origin remote
+    }
+    return { branch, head, dirty, remoteUrl };
+}
+export function collectDiagnostics() {
+    return {
+        cliVersion: CLI_VERSION,
+        nodeVersion: process.version,
+        os: {
+            platform: os.platform(),
+            release: os.release(),
+            arch: os.arch(),
+        },
+        command: sanitizeArgv(process.argv.slice(2)),
+        cwd: process.cwd(),
+        git: collectGitContext(),
+        recentSentryBreadcrumbs: getRecentBreadcrumbs(),
+    };
+}
+//# sourceMappingURL=feedback-diagnostics.js.map
+//# debugId=ee39c63b-ddaa-553d-b5db-77633d323d88

package/dist/utils/vault-api.js

@@ -1,6 +1,7 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="05d73a12-54b0-559c-a964-de7dff2d48eb")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e1ca2b83-1de0-5000-ab66-f573000a579b")}catch(e){}}();
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
+import { Sentry } from '../sentry.js';
 export async function vaultApiFetch(opts) {
     const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
     if (opts.query) {
@@ -8,14 +9,31 @@ export async function vaultApiFetch(opts) {
             url.searchParams.set(k, v);
         }
     }
-    return fetch(url.toString(), {
-        method: opts.method ?? 'GET',
+    const method = opts.method ?? 'GET';
+    const safeUrl = url.search ? `${url.origin}${url.pathname}?<redacted>` : `${url.origin}${url.pathname}`;
+    Sentry.addBreadcrumb({
+        category: "http",
+        message: `${method} ${opts.path}`,
+        level: "info",
+        data: { url: safeUrl, method },
+    });
+    const response = await fetch(url.toString(), {
+        method,
         headers: {
             Authorization: `Bearer ${opts.token}`,
             'Content-Type': 'application/json',
         },
         body: opts.body ? JSON.stringify(opts.body) : undefined,
     });
+    if (!response.ok) {
+        Sentry.addBreadcrumb({
+            category: "http",
+            message: `${method} ${opts.path} → ${response.status}`,
+            level: "warning",
+            data: { url: safeUrl, status: response.status },
+        });
+    }
+    return response;
 }
 async function resolveCompanyUid(token, slug) {
     const res = await vaultApiFetch({
@@ -88,4 +106,4 @@ export async function getEntityUid(token, opts) {
     return getCompanyUid(token, opts.companySlug);
 }
 //# sourceMappingURL=vault-api.js.map
-//# debugId=05d73a12-54b0-559c-a964-de7dff2d48eb
+//# debugId=e1ca2b83-1de0-5000-ab66-f573000a579b

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.11.0",
+  "version": "5.12.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -11,6 +11,7 @@
     "build": "node scripts/generate-dsn.mjs && tsc",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "vitest": "vitest",
     "clean": "rm -rf dist"
   },
   "dependencies": {

package/src/cli-version.ts

@@ -0,0 +1 @@
+export const CLI_VERSION = "5.12.1";