@indigoai-us/hq-cli 5.128.0 → 5.130.0

package/dist/commands/report.js

@@ -0,0 +1,310 @@
+import { ensureCognitoToken, } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+import { listReportTemplates } from "../lib/report-templates.js";
+import { adoptReport, buildReportTarball, conventionReportDir, deployOrgContext, ReportPublishError, plainFailureReason, publishReport, } from "../lib/report-publish.js";
+const DEPLOY_API_URL = process.env.HQ_DEPLOY_API_URL ?? "https://api.indigo-hq.com";
+function reportPath(channelId, reportId) {
+    return `/v1/notify/channels/${encodeURIComponent(channelId)}/reports/${encodeURIComponent(reportId)}`;
+}
+function errorMessage(error) {
+    if (error instanceof ReportPublishError)
+        return plainFailureReason(error);
+    return "Report command failed. Check the report context and try again.";
+}
+function print(value, json) {
+    if (json)
+        console.log(JSON.stringify(value, null, 2));
+    else
+        console.log(typeof value === "string" ? value : JSON.stringify(value, null, 2));
+}
+/** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
+export async function resolveReport(token, reportId, requestedChannelId) {
+    const explicit = requestedChannelId ?? process.env.HQ_REPORT_CHANNEL_ID;
+    if (explicit) {
+        const res = await vaultApiFetch({ token, path: reportPath(explicit, reportId) });
+        if (!res.ok)
+            throw new ReportPublishError("Report was not found in the supplied channel context.");
+        const body = await res.json();
+        if (!body.report)
+            throw new ReportPublishError("Report response was incomplete.");
+        return body.report;
+    }
+    // The report API is intentionally channel-scoped. Discover only among the
+    // caller's existing channels rather than inventing an unscoped report route.
+    const channels = await vaultApiFetch({ token, path: "/v1/notify/channels" });
+    if (!channels.ok)
+        throw new ReportPublishError("Could not resolve the report channel.");
+    const listed = await channels.json();
+    const matches = [];
+    for (const row of listed.channels ?? []) {
+        if (!row.channelId)
+            continue;
+        const res = await vaultApiFetch({ token, path: reportPath(row.channelId, reportId) });
+        if (res.status === 404)
+            continue;
+        if (!res.ok)
+            continue;
+        const body = await res.json();
+        if (body.report)
+            matches.push(body.report);
+    }
+    if (matches.length === 1)
+        return matches[0];
+    if (matches.length > 1)
+        throw new ReportPublishError("Report ID is ambiguous; pass --channel or set HQ_REPORT_CHANNEL_ID.");
+    throw new ReportPublishError("Report not found. Pass --channel or set HQ_REPORT_CHANNEL_ID.");
+}
+export async function patchReport(token, report, patch) {
+    const res = await vaultApiFetch({ token, path: reportPath(report.channelId, report.reportId), method: "PATCH", body: patch });
+    if (res.status === 409) {
+        const body = await res.json().catch(() => ({}));
+        if (body.error === "already-running")
+            throw new ReportPublishError("already running", "already-running");
+        throw new ReportPublishError("Report changed while it was being updated.");
+    }
+    if (!res.ok)
+        throw new ReportPublishError("Could not update the report record.");
+    const body = await res.json();
+    if (!body.report)
+        throw new ReportPublishError("Report update response was incomplete.");
+    return body.report;
+}
+function deployHeaders(token, json = true, extra = {}) {
+    return {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...(json ? { "Content-Type": "application/json" } : {}),
+        ...extra,
+    };
+}
+async function deployJson(token, route, method, body, extraHeaders = {}) {
+    let res;
+    try {
+        res = await fetch(`${DEPLOY_API_URL.replace(/\/+$/, "")}${route}`, {
+            method,
+            headers: deployHeaders(token, body !== undefined, extraHeaders),
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+    }
+    catch {
+        throw new ReportPublishError("Could not reach hq-deploy.");
+    }
+    if (!res.ok)
+        throw new ReportPublishError("hq-deploy rejected the report deployment.");
+    return await res.json();
+}
+export async function resolveCompanySlug(token, companyUid) {
+    const res = await vaultApiFetch({ token, path: `/entity/${encodeURIComponent(companyUid)}` });
+    if (!res.ok)
+        throw new ReportPublishError("Could not resolve the report's company for deploy.");
+    const body = await res.json();
+    const slug = body.entity?.slug;
+    if (!slug)
+        throw new ReportPublishError("Could not resolve the report's company for deploy.");
+    return slug;
+}
+async function orgFor(token, report) {
+    const slug = report.companyUid ? await resolveCompanySlug(token, report.companyUid) : undefined;
+    return deployOrgContext(report, slug);
+}
+async function findOrCreateApp(token, slug, org) {
+    const listed = await deployJson(token, "/api/apps", "GET", undefined, org.headers);
+    const existing = Array.isArray(listed.apps)
+        ? listed.apps.find((app) => !!app && typeof app === "object" && (app.subdomain === slug || app.name === slug))
+        : undefined;
+    const app = existing ?? await deployJson(token, "/api/apps", "POST", { name: slug, type: "static" }, org.headers);
+    const id = typeof app.id === "string" ? app.id : undefined;
+    const subdomain = typeof app.subdomain === "string" ? app.subdomain : undefined;
+    if (!id || !subdomain)
+        throw new ReportPublishError("hq-deploy returned an incomplete app record.");
+    return { id, subdomain };
+}
+export async function deployReportStatic(token, input) {
+    const app = await findOrCreateApp(token, input.slug, input.org);
+    await deployJson(token, `/api/apps/${encodeURIComponent(app.id)}/access-policy`, "PUT", input.access, input.org.headers);
+    const tarball = buildReportTarball(input.files);
+    const deployment = await deployJson(token, "/api/deploys", "POST", {
+        appSlug: app.subdomain,
+        ...(input.org.org ? { org: input.org.org } : {}),
+        manifest: { files: [], size: tarball.sizeBytes, sha256: tarball.sha256 },
+    }, input.org.headers);
+    const deployId = typeof deployment.deployId === "string" ? deployment.deployId : undefined;
+    const presignedUrl = typeof deployment.presignedUrl === "string" ? deployment.presignedUrl : undefined;
+    if (!deployId || !presignedUrl)
+        throw new ReportPublishError("hq-deploy did not create an upload.");
+    let upload;
+    try {
+        upload = await fetch(presignedUrl, { method: "PUT", headers: { "Content-Type": "application/gzip" }, body: tarball.bytes });
+    }
+    catch {
+        throw new ReportPublishError("Report upload failed.");
+    }
+    if (!upload.ok)
+        throw new ReportPublishError("Report upload failed.");
+    const completed = await deployJson(token, `/api/deploys/${encodeURIComponent(deployId)}/complete`, "POST", { appSlug: app.subdomain }, input.org.headers);
+    const url = typeof completed.url === "string" ? completed.url : `https://${app.subdomain}.indigo-hq.com`;
+    return { appId: app.id, url, deployId };
+}
+async function publishWithOrg(token, report, directory, draft) {
+    return publishReport(report, directory, draft, {
+        patch: (current, patch) => patchReport(token, current, patch),
+        deploy: async (input) => {
+            const org = await orgFor(token, report);
+            return deployReportStatic(token, { ...input, org });
+        },
+        now: () => new Date().toISOString(),
+    });
+}
+async function publishAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    print(await publishWithOrg(token, report, options.dir, options.draft === true), options.json === true);
+}
+async function promoteAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const directory = options.dir?.trim() ? options.dir : conventionReportDir(reportId);
+    const published = await publishWithOrg(token, report, directory, false);
+    // A promotion makes the freshly deployed live page authoritative. Null clears
+    // the draft pointer; omitting the field would leave the old draft in place.
+    const updated = published.draft
+        ? await patchReport(token, published, { draft: null, state: "live" })
+        : published;
+    print(updated, options.json === true);
+}
+async function getAction(reportId, options) {
+    const report = await resolveReport(await ensureCognitoToken(), reportId, options.channel);
+    print(report, options.json === true);
+}
+async function discardDraftAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const org = await orgFor(token, report);
+    if (report.draft?.appId) {
+        const res = await fetch(`${DEPLOY_API_URL.replace(/\/+$/, "")}/api/apps/${encodeURIComponent(report.draft.appId)}`, {
+            method: "DELETE",
+            headers: deployHeaders(token, false, org.headers),
+        });
+        if (!res.ok && res.status !== 404)
+            throw new ReportPublishError("Could not remove the draft deployment.");
+    }
+    const updated = await patchReport(token, report, { draft: null, state: report.url ? "live" : "draft-pending" });
+    print(updated, options.json === true);
+}
+async function accessAction(reportId, options) {
+    if (!["company", "selected", "password", "public"].includes(options.mode)) {
+        throw new ReportPublishError("Access mode must be company, selected, password, or public.");
+    }
+    if (options.mode === "password" && !options.password) {
+        throw new ReportPublishError("A password is required for password access mode.");
+    }
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const appId = report.deployAppId ?? report.draft?.appId;
+    if (!appId)
+        throw new ReportPublishError("Publish the report before changing its access policy.");
+    const companyUid = report.companyUid ?? "personal";
+    const policy = {
+        mode: options.mode,
+        companyUid,
+        users: options.mode === "selected" ? [{ id: report.createdBy }] : [],
+        groups: [],
+        ...(options.mode === "password" && options.password ? { password: options.password } : {}),
+    };
+    const org = await orgFor(token, report);
+    const result = await deployJson(token, `/api/apps/${encodeURIComponent(appId)}/access-policy`, "PUT", policy, org.headers);
+    print(result, options.json === true);
+}
+async function cancelOwnedJob(token, agentUid, jobId) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/jobs/${encodeURIComponent(jobId)}/cancel`,
+        method: "POST",
+    });
+    if (!res.ok && res.status !== 404)
+        throw new ReportPublishError("Could not remove the report job.");
+}
+async function adoptAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const updated = await adoptReport(report, {
+        cancelJob: (jobId) => cancelOwnedJob(token, report.ownerAgentUid, jobId),
+        createJob: async (input) => {
+            const res = await vaultApiFetch({
+                token,
+                path: `/v1/agents/${encodeURIComponent(report.ownerAgentUid)}/jobs`,
+                method: "POST",
+                body: input,
+            });
+            if (!res.ok)
+                throw new ReportPublishError("Could not install the report job.");
+            const body = await res.json();
+            const jobId = body.job?.jobId ?? body.jobId;
+            if (!jobId)
+                throw new ReportPublishError("Jobs API returned an incomplete job.");
+            return { jobId };
+        },
+        patch: (current, patch) => patchReport(token, current, patch),
+    });
+    print(updated, options.json === true);
+}
+async function decommissionAction(reportId, options) {
+    const token = await ensureCognitoToken();
+    const report = await resolveReport(token, reportId, options.channel);
+    const org = await orgFor(token, report);
+    const leftover = [];
+    for (const id of [report.deployAppId, report.draft?.appId]) {
+        if (!id)
+            continue;
+        try {
+            const res = await fetch(`${DEPLOY_API_URL.replace(/\/+$/, "")}/api/apps/${encodeURIComponent(id)}`, {
+                method: "DELETE",
+                headers: deployHeaders(token, false, org.headers),
+            });
+            if (res.status === 404)
+                leftover.push("The published page was already gone.");
+            else if (!res.ok)
+                leftover.push("A deployment could not be deactivated.");
+        }
+        catch {
+            leftover.push("A deployment could not be reached.");
+        }
+    }
+    // The durable report is marked decommissioned by hq-pro before this prompt.
+    // Cleanup gaps stay on the result so a missing app or offline bot does not roll the record back.
+    if (report.jobId) {
+        try {
+            await cancelOwnedJob(token, report.ownerAgentUid, report.jobId);
+        }
+        catch {
+            leftover.push("The report job is still installed.");
+        }
+    }
+    const note = leftover.length ? [...new Set(leftover)].join(" ") : null;
+    print({ reportId: report.reportId, decommissioned: true, note }, options.json === true);
+}
+export function registerReportCommand(program) {
+    const report = program.command("report").description("Publish and manage a channel report owned by this bot.");
+    const context = (command) => command.option("--channel <channelId>", "report channel context (or set HQ_REPORT_CHANNEL_ID)");
+    context(report.command("get <reportId>").option("--json").action((reportId, options) => runReportCommand(() => getAction(reportId, options))));
+    context(report.command("publish <reportId>").requiredOption("--dir <path>").option("--draft").option("--json").action((reportId, options) => runReportCommand(() => publishAction(reportId, options))));
+    context(report.command("promote <reportId>").option("--dir <path>", "report folder; defaults to <workerDir>/reports/<reportId>").option("--json").action((reportId, options) => runReportCommand(() => promoteAction(reportId, options))));
+    context(report.command("discard-draft <reportId>").option("--json").action((reportId, options) => runReportCommand(() => discardDraftAction(reportId, options))));
+    context(report.command("access <reportId>").requiredOption("--mode <mode>", "company|selected|password|public").option("--password <password>").option("--json").action((reportId, options) => runReportCommand(() => accessAction(reportId, options))));
+    context(report.command("decommission <reportId>").option("--json").action((reportId, options) => runReportCommand(() => decommissionAction(reportId, options))));
+    context(report.command("adopt <reportId>").option("--json").action((reportId, options) => runReportCommand(() => adoptAction(reportId, options))));
+    report.command("templates").option("--json").action((options) => {
+        const templates = listReportTemplates().map(({ name, path: templatePath }) => ({ name, path: templatePath }));
+        print(templates, options.json === true);
+    });
+}
+export async function runReportCommand(action) {
+    try {
+        await action();
+    }
+    catch (error) {
+        console.error(errorMessage(error));
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=report.js.map

package/dist/lib/core-utils/sentry-report.d.ts

@@ -3,14 +3,17 @@
  *
  * The stdin event schema is deliberately closed. Hook payloads can contain
  * commands, prompts, source content, transcript locations, and credentials, so
- * this module accepts only a small set of scalar diagnostics and never reads a
- * hook payload or the process environment. The owner-approved `hook_path`
+ * this module accepts only a small set of scalar diagnostics plus bounded hook
+ * history and never reads a hook payload or the process environment. The
+ * owner-approved `hook_path`
  * diagnostic is the narrow exception: it names the slow hook script and may
  * include its company directory, but never carries the hook payload itself.
  *
- * Invalid top-level input and structurally rich metadata are rejected rather
- * than truncated. Unknown scalar metadata is dropped instead: the allowlist,
- * not a caller version match, determines what may leave the machine.
+ * Invalid top-level input and structurally rich metadata are rejected. The
+ * bounded hook sequence is the deliberate exception: it keeps only the most
+ * recent entries so diagnostics cannot expand the transport payload. Unknown
+ * scalar metadata is dropped instead: the allowlist, not a caller version
+ * match, determines what may leave the machine.
  */
 import * as Sentry from "@sentry/node";
 import type { CaptureContext, SeverityLevel } from "@sentry/node";
@@ -24,9 +27,15 @@ export declare const MAX_SENTRY_REPORT_METADATA_VALUE_BYTES = 256;
  * is owner-approved telemetry for the exact hook script and may include a
  * company directory; it is never a substitute for hook input or a transcript.
  */
-export declare const ALLOWED_SENTRY_REPORT_METADATA_KEYS: readonly ["hook_name", "hook_path", "hook_event", "tool_name", "session_id", "declared_timeout_ms", "elapsed_ms", "remaining_ms", "watchdog_timeout_ms", "hook_timeout_ms", "hq_version", "platform", "load_average"];
+export declare const ALLOWED_SENTRY_REPORT_METADATA_KEYS: readonly ["hook_name", "hook_path", "hook_event", "hook_script", "tool_name", "session_id", "declared_timeout_ms", "elapsed_ms", "remaining_ms", "watchdog_timeout_ms", "hook_timeout_ms", "hq_version", "platform", "load_average", "exit_code", "final_elapsed_ms", "bash_env_set", "cwd_kind", "shell", "nproc", "hook_sequence"];
 export declare const MAX_SENTRY_REPORT_METADATA_KEYS: number;
-export type SentryReportMetadata = Record<string, string | number | boolean>;
+export type HookSequenceEntry = {
+    script: string;
+    event: string;
+    ms: number;
+};
+export type SentryReportMetadataValue = string | number | boolean | HookSequenceEntry[];
+export type SentryReportMetadata = Record<string, SentryReportMetadataValue>;
 export type SentryReportEvent = {
     type: string;
     message: string;
@@ -38,15 +47,26 @@ export type SentryReportOptions = {
     dryRun?: boolean;
     /** Total time reserved for the report flush after validation. */
     timeoutMs?: number;
+    /** Explicit live HQ root supplied by `hq core --hq-root`. */
+    hqRoot?: string;
+    /** Test seam for the bounded timeout-report stamp store. */
+    rateLimitDirectory?: string;
+    /** Test seam for deterministic rate-limit windows. */
+    rateLimitNow?: () => number;
 };
 export type SentryReportDependencies = {
     sentry: {
         captureMessage: (message: string, context?: CaptureContext | SeverityLevel) => string;
+        addBreadcrumb: (breadcrumb: Parameters<typeof Sentry.addBreadcrumb>[0]) => void;
         metrics: Pick<typeof Sentry.metrics, "count">;
         flush: (timeout?: number) => PromiseLike<boolean>;
     };
     stdout: Pick<NodeJS.WriteStream, "write">;
     stderr: Pick<NodeJS.WriteStream, "write">;
+    /** Test seam; production resolves the live HQ workspace tmp directory. */
+    rateLimitDirectory?: string;
+    /** Test seam; production uses Date.now. */
+    rateLimitNow?: () => number;
 };
 export type SentryReportResult = {
     code: 0 | 1;