@indigoai-us/hq-cli 5.12.4 → 5.13.0

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="217ceadb-01cd-5778-9cc0-6f6d895d8d67")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b75c8495-7e0e-53f8-a0d2-c92a993e6492")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -467,7 +467,6 @@ export function registerSecretsCommand(program) {
         .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
         .action(async (name, opts) => {
         try {
-            rejectIfPersonal(secrets.opts(), "generate-link");
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
@@ -713,4 +712,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=217ceadb-01cd-5778-9cc0-6f6d895d8d67
+//# debugId=b75c8495-7e0e-53f8-a0d2-c92a993e6492

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="efa927a6-3cad-5122-928e-f7b055b533e8")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="56a9367e-c800-55df-9c55-44274965648e")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -31,6 +31,15 @@ import { registerMembersCommand } from "./commands/members.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
+// Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes the pipe early.
+const onPipeError = (err) => {
+    if (err.code === "EPIPE") {
+        process.exit(0);
+    }
+    throw err;
+};
+process.stdout.on("error", onPipeError);
+process.stderr.on("error", onPipeError);
 initSentry();
 maybeWarnNewVersion();
 const program = new Command();
@@ -110,4 +119,4 @@ registerFeedbackCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=efa927a6-3cad-5122-928e-f7b055b533e8
+//# debugId=56a9367e-c800-55df-9c55-44274965648e

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.12.4",
+  "version": "5.13.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/cloud.push-all.test.ts

@@ -0,0 +1,381 @@
+/**
+ * Unit tests for `pushAll` — the orchestrator behind `hq sync push --all`.
+ *
+ * Mirrors the DI layout used in `cloud.pull-all.test.ts`: pushAll takes a
+ * `VaultClient`-shaped adapter and a `share`-shaped function as deps, so
+ * the tests can exercise the membership + canonical-person fanout without
+ * touching the network or the real share() implementation.
+ *
+ * Personal paths are computed via the real `computePersonalVaultPaths` so
+ * we verify the hqRoot scope on disk. Each test that exercises personal
+ * uses an isolated tmpdir with known top-level entries.
+ */
+
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+
+import {
+  pushAll,
+  type PushAllDeps,
+  type PullAllVaultClient,
+  type ShareCallOptions,
+  type ShareCallResult,
+} from "./cloud.js";
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+interface FakeMembership {
+  companyUid: string;
+}
+
+interface FakeEntity {
+  uid: string;
+  type: "person" | "company";
+  slug: string;
+  bucketName?: string;
+  createdAt: string;
+}
+
+function makeVaultClient(opts: {
+  memberships?: FakeMembership[];
+  persons?: FakeEntity[];
+  entitiesBySlug?: Record<string, { slug: string; name?: string }>;
+  failGetEntityFor?: Set<string>;
+}): PullAllVaultClient {
+  return {
+    listMyMemberships: vi
+      .fn<[], Promise<FakeMembership[]>>()
+      .mockResolvedValue(opts.memberships ?? []),
+    listPersonEntities: vi
+      .fn<[], Promise<FakeEntity[]>>()
+      .mockResolvedValue(opts.persons ?? []),
+    getEntity: vi
+      .fn<[string], Promise<{ slug?: string; name?: string } | null>>()
+      .mockImplementation(async (uid: string) => {
+        if (opts.failGetEntityFor?.has(uid)) {
+          throw new Error(`fake getEntity failure for ${uid}`);
+        }
+        return opts.entitiesBySlug?.[uid] ?? null;
+      }),
+  };
+}
+
+function makeShareSpy(
+  perCallOverrides: Record<string, Partial<ShareCallResult> | Error> = {},
+): {
+  fn: PushAllDeps["share"];
+  calls: ShareCallOptions[];
+} {
+  const calls: ShareCallOptions[] = [];
+  const fn: PushAllDeps["share"] = vi
+    .fn<[ShareCallOptions], Promise<ShareCallResult>>()
+    .mockImplementation(async (options: ShareCallOptions) => {
+      calls.push(options);
+      const override = perCallOverrides[options.company];
+      if (override instanceof Error) {
+        throw override;
+      }
+      return {
+        filesUploaded: 0,
+        bytesUploaded: 0,
+        filesSkipped: 0,
+        filesDeleted: 0,
+        conflictPaths: [],
+        aborted: false,
+        ...override,
+      };
+    });
+  return { fn, calls };
+}
+
+// Create a tmpdir hqRoot with a known set of top-level entries so the
+// personal-vault path computation produces a stable expected output.
+let tmpHqRoots: string[] = [];
+
+function makeHqRoot(topLevelEntries: string[]): string {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-pushall-test-"));
+  for (const name of topLevelEntries) {
+    fs.mkdirSync(path.join(root, name), { recursive: true });
+  }
+  tmpHqRoots.push(root);
+  return root;
+}
+
+beforeEach(() => {
+  tmpHqRoots = [];
+});
+
+afterEach(() => {
+  for (const root of tmpHqRoots) {
+    try {
+      fs.rmSync(root, { recursive: true, force: true });
+    } catch {
+      // Best-effort cleanup.
+    }
+  }
+});
+
+// ── 1. Happy path ───────────────────────────────────────────────────────────
+
+describe("pushAll", () => {
+  it("pushes every membership plus the canonical person entity", async () => {
+    const hqRoot = makeHqRoot([
+      ".git",
+      "companies",
+      "repos",
+      "workspace",
+      ".claude",
+      "knowledge",
+      "personal",
+    ]);
+    const vaultClient = makeVaultClient({
+      memberships: [
+        { companyUid: "cmp_acme" },
+        { companyUid: "cmp_globex" },
+      ],
+      persons: [
+        {
+          uid: "psn_alice",
+          type: "person",
+          slug: "alice",
+          bucketName: "hq-vault-psn-alice",
+          createdAt: "2026-01-01T00:00:00Z",
+        },
+      ],
+      entitiesBySlug: {
+        cmp_acme: { slug: "acme", name: "Acme" },
+        cmp_globex: { slug: "globex", name: "Globex" },
+      },
+    });
+    const share = makeShareSpy({
+      cmp_acme: { filesUploaded: 4, bytesUploaded: 400 },
+      cmp_globex: { filesUploaded: 1, bytesUploaded: 50 },
+      psn_alice: { filesUploaded: 9, bytesUploaded: 900 },
+    });
+
+    const result = await pushAll(
+      { hqRoot, onConflict: "abort" },
+      { vaultClient, share: share.fn },
+    );
+
+    expect(share.calls).toHaveLength(3);
+    expect(share.calls[0]).toMatchObject({
+      company: "cmp_acme",
+      hqRoot,
+      paths: [path.join(hqRoot, "companies", "acme")],
+      onConflict: "abort",
+      skipUnchanged: true,
+      propagateDeletes: true,
+    });
+    expect(share.calls[1]).toMatchObject({
+      company: "cmp_globex",
+      paths: [path.join(hqRoot, "companies", "globex")],
+    });
+    expect(share.calls[2]).toMatchObject({
+      company: "psn_alice",
+      personalMode: true,
+      journalSlug: "personal",
+      skipUnchanged: true,
+      propagateDeletes: true,
+    });
+    // Personal paths excludes .git/companies/repos/workspace, keeps the rest.
+    expect(new Set(share.calls[2].paths)).toEqual(
+      new Set([
+        path.join(hqRoot, ".claude"),
+        path.join(hqRoot, "knowledge"),
+        path.join(hqRoot, "personal"),
+      ]),
+    );
+
+    expect(result.attempted).toBe(3);
+    expect(result.filesUploaded).toBe(14);
+    expect(result.bytesUploaded).toBe(1350);
+    expect(result.errors).toEqual([]);
+    expect(result.perCompany.map((row) => row.slug)).toEqual([
+      "acme",
+      "globex",
+      "personal",
+    ]);
+  });
+
+  // ── 2. Conflict + message passthrough ─────────────────────────────────────
+
+  it("forwards --on-conflict and --message to every share() call", async () => {
+    const hqRoot = makeHqRoot(["companies", ".claude"]);
+    const vaultClient = makeVaultClient({
+      memberships: [{ companyUid: "cmp_acme" }],
+      persons: [
+        {
+          uid: "psn_alice",
+          type: "person",
+          slug: "alice",
+          createdAt: "2026-01-01T00:00:00Z",
+        },
+      ],
+    });
+    const share = makeShareSpy();
+
+    await pushAll(
+      { hqRoot, onConflict: "overwrite", message: "test broadcast" },
+      { vaultClient, share: share.fn },
+    );
+
+    for (const call of share.calls) {
+      expect(call.onConflict).toBe("overwrite");
+      expect(call.message).toBe("test broadcast");
+      expect(call.skipUnchanged).toBe(true);
+      expect(call.propagateDeletes).toBe(true);
+    }
+  });
+
+  // ── 3. Per-company error isolation ────────────────────────────────────────
+
+  it("continues past a per-company share failure and reports it in errors[]", async () => {
+    const hqRoot = makeHqRoot(["companies"]);
+    const vaultClient = makeVaultClient({
+      memberships: [
+        { companyUid: "cmp_acme" },
+        { companyUid: "cmp_globex" },
+      ],
+      persons: [],
+      entitiesBySlug: {
+        cmp_acme: { slug: "acme" },
+        cmp_globex: { slug: "globex" },
+      },
+    });
+    const share = makeShareSpy({
+      cmp_globex: new Error("STS denied"),
+    });
+
+    const result = await pushAll(
+      { hqRoot },
+      { vaultClient, share: share.fn },
+    );
+
+    expect(share.calls.map((c) => c.company)).toEqual([
+      "cmp_acme",
+      "cmp_globex",
+    ]);
+    expect(result.attempted).toBe(2);
+    expect(result.errors).toEqual([
+      { company: "globex", message: "STS denied" },
+    ]);
+    const globexRow = result.perCompany.find((r) => r.slug === "globex");
+    expect(globexRow?.error).toBe("STS denied");
+    expect(globexRow?.result).toBeUndefined();
+  });
+
+  // ── 4. No person entity ────────────────────────────────────────────────────
+
+  it("omits the personal target when listPersonEntities returns []", async () => {
+    const hqRoot = makeHqRoot(["companies"]);
+    const vaultClient = makeVaultClient({
+      memberships: [{ companyUid: "cmp_acme" }],
+      persons: [],
+      entitiesBySlug: { cmp_acme: { slug: "acme" } },
+    });
+    const share = makeShareSpy();
+
+    const result = await pushAll(
+      { hqRoot },
+      { vaultClient, share: share.fn },
+    );
+
+    expect(share.calls).toHaveLength(1);
+    expect(share.calls[0].company).toBe("cmp_acme");
+    expect(share.calls[0].personalMode).toBeUndefined();
+    expect(result.perCompany.map((r) => r.slug)).toEqual(["acme"]);
+  });
+
+  // ── 5. No memberships and no person entity ────────────────────────────────
+
+  it("returns cleanly with zero attempts when there is nothing to push", async () => {
+    const hqRoot = makeHqRoot([]);
+    const vaultClient = makeVaultClient({});
+    const share = makeShareSpy();
+
+    const result = await pushAll(
+      { hqRoot },
+      { vaultClient, share: share.fn },
+    );
+
+    expect(share.calls).toEqual([]);
+    expect(result).toEqual({
+      attempted: 0,
+      filesUploaded: 0,
+      bytesUploaded: 0,
+      filesDeleted: 0,
+      errors: [],
+      perCompany: [],
+    });
+  });
+
+  // ── 6. Canonical-person tiebreak ──────────────────────────────────────────
+
+  it("picks the oldest person entity, breaking ties by uid", async () => {
+    const hqRoot = makeHqRoot(["docs"]);
+    const vaultClient = makeVaultClient({
+      memberships: [],
+      persons: [
+        {
+          uid: "psn_zzz",
+          type: "person",
+          slug: "alice-zzz",
+          createdAt: "2026-01-01T00:00:00Z",
+        },
+        {
+          uid: "psn_aaa",
+          type: "person",
+          slug: "alice-aaa",
+          createdAt: "2026-01-01T00:00:00Z",
+        },
+        {
+          uid: "psn_old",
+          type: "person",
+          slug: "alice-old",
+          createdAt: "2025-06-01T00:00:00Z",
+        },
+      ],
+    });
+    const share = makeShareSpy();
+
+    await pushAll({ hqRoot }, { vaultClient, share: share.fn });
+
+    expect(share.calls).toHaveLength(1);
+    expect(share.calls[0].company).toBe("psn_old");
+    expect(share.calls[0].personalMode).toBe(true);
+    expect(share.calls[0].journalSlug).toBe("personal");
+  });
+
+  // ── 7. Aggregate counts include deletes ───────────────────────────────────
+
+  it("aggregates filesDeleted across every successful target", async () => {
+    const hqRoot = makeHqRoot(["companies", "docs"]);
+    const vaultClient = makeVaultClient({
+      memberships: [{ companyUid: "cmp_acme" }],
+      persons: [
+        {
+          uid: "psn_alice",
+          type: "person",
+          slug: "alice",
+          createdAt: "2026-01-01T00:00:00Z",
+        },
+      ],
+      entitiesBySlug: { cmp_acme: { slug: "acme" } },
+    });
+    const share = makeShareSpy({
+      cmp_acme: { filesUploaded: 2, filesDeleted: 1 },
+      psn_alice: { filesUploaded: 1, filesDeleted: 3 },
+    });
+
+    const result = await pushAll(
+      { hqRoot },
+      { vaultClient, share: share.fn },
+    );
+
+    expect(result.filesUploaded).toBe(3);
+    expect(result.filesDeleted).toBe(4);
+  });
+});

package/src/commands/cloud.selectors.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Unit tests for the two small helpers that underpin the new `hq sync`
+ * routing flags:
+ *
+ *   - `assertSingleSelector`: refuses ambiguous combinations of --all,
+ *     --personal, and --company.
+ *   - `resolveCanonicalPersonUid`: looks up the caller's canonical person
+ *     entity and surfaces a clean error when none exists.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  assertSingleSelector,
+  resolveCanonicalPersonUid,
+  type PullAllVaultClient,
+} from "./cloud.js";
+
+// ── assertSingleSelector ────────────────────────────────────────────────────
+
+describe("assertSingleSelector", () => {
+  it("accepts no selectors (= use active company)", () => {
+    expect(() => assertSingleSelector({}, "pull")).not.toThrow();
+  });
+
+  it.each([
+    ["all only", { all: true }],
+    ["personal only", { personal: true }],
+    ["company only", { company: "acme" }],
+  ])("accepts a single selector: %s", (_label, opts) => {
+    expect(() => assertSingleSelector(opts, "push")).not.toThrow();
+  });
+
+  it.each([
+    [
+      "all + personal",
+      { all: true, personal: true },
+      ["--all", "--personal"],
+    ],
+    [
+      "all + company",
+      { all: true, company: "acme" },
+      ["--all", "--company acme"],
+    ],
+    [
+      "personal + company",
+      { personal: true, company: "acme" },
+      ["--personal", "--company acme"],
+    ],
+    [
+      "all + personal + company",
+      { all: true, personal: true, company: "acme" },
+      ["--all", "--personal", "--company acme"],
+    ],
+  ])(
+    "throws on conflicting selectors: %s",
+    (_label, opts, mentioned: string[]) => {
+      let caught: Error | null = null;
+      try {
+        assertSingleSelector(opts, "now");
+      } catch (err) {
+        caught = err as Error;
+      }
+      expect(caught).not.toBeNull();
+      expect(caught?.message).toMatch(/at most one of --all, --personal, --company/);
+      for (const flag of mentioned) {
+        expect(caught?.message).toContain(flag);
+      }
+    },
+  );
+
+  it("interpolates the command name in the error message", () => {
+    expect(() =>
+      assertSingleSelector({ all: true, personal: true }, "push"),
+    ).toThrow(/`hq sync push`/);
+  });
+});
+
+// ── resolveCanonicalPersonUid ──────────────────────────────────────────────
+
+function makeClient(persons: Array<{
+  uid: string;
+  type: "person" | "company";
+  slug: string;
+  createdAt: string;
+}>): PullAllVaultClient {
+  return {
+    listMyMemberships: vi.fn().mockResolvedValue([]),
+    listPersonEntities: vi.fn().mockResolvedValue(persons),
+    getEntity: vi.fn().mockResolvedValue(null),
+  };
+}
+
+describe("resolveCanonicalPersonUid", () => {
+  it("returns the UID of the canonical (oldest) person entity", async () => {
+    const client = makeClient([
+      {
+        uid: "psn_new",
+        type: "person",
+        slug: "alice",
+        createdAt: "2026-04-01T00:00:00Z",
+      },
+      {
+        uid: "psn_old",
+        type: "person",
+        slug: "alice-old",
+        createdAt: "2025-06-01T00:00:00Z",
+      },
+    ]);
+
+    await expect(resolveCanonicalPersonUid(client)).resolves.toBe("psn_old");
+  });
+
+  it("throws a clean error when no person entity is present", async () => {
+    const client = makeClient([]);
+    await expect(resolveCanonicalPersonUid(client)).rejects.toThrow(
+      /No personal vault found/,
+    );
+  });
+
+  it("breaks createdAt ties by uid lex order (deterministic)", async () => {
+    const client = makeClient([
+      {
+        uid: "psn_zzz",
+        type: "person",
+        slug: "alice-zzz",
+        createdAt: "2026-01-01T00:00:00Z",
+      },
+      {
+        uid: "psn_aaa",
+        type: "person",
+        slug: "alice-aaa",
+        createdAt: "2026-01-01T00:00:00Z",
+      },
+    ]);
+
+    await expect(resolveCanonicalPersonUid(client)).resolves.toBe("psn_aaa");
+  });
+
+  it("ignores non-person entities returned by the client", async () => {
+    const client: PullAllVaultClient = {
+      listMyMemberships: vi.fn().mockResolvedValue([]),
+      listPersonEntities: vi.fn().mockResolvedValue([
+        // Belt-and-braces: callers today pass entity.listByType("person"),
+        // but a future caller passing a mixed list shouldn't silently pick a
+        // company entity.
+        { uid: "cmp_acme", type: "company", slug: "acme", createdAt: "2024-01-01T00:00:00Z" },
+        { uid: "psn_alice", type: "person", slug: "alice", createdAt: "2026-01-01T00:00:00Z" },
+      ]),
+      getEntity: vi.fn().mockResolvedValue(null),
+    };
+
+    await expect(resolveCanonicalPersonUid(client)).resolves.toBe("psn_alice");
+  });
+});