@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/utils/plan-gate-error.js

@@ -1,155 +1,12 @@
-/**
- * A deliberate subscription denial returned by hq-pro. Keeping its structured
- * fields on a typed error lets the CLI boundary render one safe, consistent
- * message instead of every command parsing and printing a server response.
- */
-import { PLAN_LIMIT_DIMENSION_LABELS, renderPersonalPlanFeatureNotice, } from "../lib/plan-limit-nag.js";
-import { withCliLimitEntrySurface } from "../lib/billing/plan-limit-upgrade-url.js";
-import { parseFreeMonth, } from "../lib/billing/free-month.js";
-const GIB = 1024 ** 3;
-const MIB = 1024 ** 2;
-const KIB = 1024;
-function formatStorageBytes(bytes) {
-    const round = (value) => String(Math.round(value * 10) / 10);
-    if (bytes >= GIB)
-        return `${round(bytes / GIB)} GB`;
-    if (bytes >= MIB)
-        return `${round(bytes / MIB)} MB`;
-    if (bytes >= KIB)
-        return `${round(bytes / KIB)} KB`;
-    return `${bytes} bytes`;
-}
-function formatResourceAmount(resource, amount) {
-    return resource === "storageBytes" ? formatStorageBytes(amount) : String(amount);
-}
-function resourceLabel(resource) {
-    const label = PLAN_LIMIT_DIMENSION_LABELS[resource] ?? resource;
-    return label.charAt(0).toUpperCase() + label.slice(1);
-}
-/** The trim-back action for one resource, phrased as what the user does. */
-function resourceFixAction(resource) {
-    switch (resource) {
-        case "users":
-            return "Remove members";
-        case "secrets":
-            return "Delete secrets";
-        case "integrations":
-            return "Disconnect integrations";
-        case "storageBytes":
-            return "Delete files";
-        case "agents":
-            return "Deprovision agents";
-        case "deployments":
-            return "Remove deployments";
-        default:
-            return `Reduce ${PLAN_LIMIT_DIMENSION_LABELS[resource] ?? resource}`;
-    }
-}
-/**
- * Render a plan-limit refusal: the server's sentence, where each over
- * resource stands, then every way out the server offered. Only the fix options
- * the server actually sent are listed, so the CLI never suggests trimming a
- * dimension nobody measured.
- */
-function planLimitRefusalText(head, details) {
-    const lines = [head];
-    for (const row of details.resources ?? []) {
-        lines.push(`  ${resourceLabel(row.resource)}: ` +
-            `${formatResourceAmount(row.resource, row.used)} of ` +
-            `${formatResourceAmount(row.resource, row.limit)} used.`);
-    }
-    const fixes = [];
-    const freeMonthUrl = safeUpgradeUrl(details.freeMonth?.url);
-    if (details.freeMonth?.eligible && freeMonthUrl) {
-        fixes.push(`Start your free month — add a card, first month free: ${freeMonthUrl}`);
-    }
-    for (const [resource, target] of Object.entries(details.fixOptions ?? {})) {
-        fixes.push(`${resourceFixAction(resource)} to make room (your plan allows ` +
-            `${formatResourceAmount(resource, target)}).`);
-    }
-    if (fixes.length > 0) {
-        fixes.push("Upgrade your plan.");
-        lines.push("  Ways to sort it:");
-        fixes.forEach((fix, index) => lines.push(`    ${index + 1}. ${fix}`));
-    }
-    return lines.join("\n");
-}
-function planGateReason(code, details) {
-    if (code === "PLAN_LIMIT_EXCEEDED") {
-        const head = details.reason?.trim()
-            ? details.reason.trim()
-            : typeof details.resource === "string" &&
-                typeof details.used === "number" &&
-                typeof details.limit === "number"
-                ? `Starter plan limit reached: ${details.resource} ${details.used}/${details.limit} used.`
-                : details.resources?.length || details.fixOptions || details.freeMonth
-                    ? "Your plan limit has been reached."
-                    : undefined;
-        if (head)
-            return planLimitRefusalText(head, details);
-    }
-    if (details.reason?.trim())
-        return details.reason.trim();
-    if (code === "PERSONAL_PLAN_REQUIRED") {
-        return renderPersonalPlanFeatureNotice(details.feature ?? "this feature", null);
-    }
-    if (code === "MEETING_PLAN_REQUIRED") {
-        return "HQ Workforce plan required to invite a meeting bot.";
-    }
-    if (code === "BILLING_REQUIRED") {
-        return "Upgrade the company plan before enrolling an external agent.";
-    }
-    return "HQ Workforce plan required for this feature.";
-}
-/** One renderer for server-selected upgrade links across CLI plan refusals. */
-export function formatUpgradeRefusal(reason, upgradeUrl, options = {}) {
-    const safeUrl = safeUpgradeUrl(upgradeUrl);
-    const cliLimitUrl = safeUrl ? withCliLimitEntrySurface(safeUrl) : undefined;
-    if (options.urlOnly && cliLimitUrl)
-        return cliLimitUrl;
-    if (!cliLimitUrl)
-        return reason;
-    return `${reason}\nUpgrade: ${cliLimitUrl}`;
-}
-function safeUpgradeUrl(value) {
-    if (typeof value !== "string" ||
-        value.trim() !== value ||
-        !/^https:\/\//i.test(value)) {
-        return undefined;
-    }
-    try {
-        const url = new URL(value);
-        if (url.protocol !== "https:" ||
-            !url.hostname ||
-            url.username ||
-            url.password) {
-            return undefined;
-        }
-    }
-    catch {
-        return undefined;
-    }
-    return value;
-}
-/** Recover a company UID only from the server's UID-keyed billing callback. */
-export function companyUidFromPlanUpgradeUrl(value) {
-    const safeUrl = safeUpgradeUrl(value);
-    if (!safeUrl)
-        return undefined;
-    const callbackUrl = new URL(safeUrl).searchParams.get("callbackUrl");
-    if (!callbackUrl)
-        return undefined;
-    const match = /^\/api\/companies\/(cmp_[A-Za-z0-9_-]+)\/billing\/upgrade\/?$/.exec(callbackUrl);
-    return match?.[1];
-}
-function formatPlanGateErrorText(code, details) {
-    return formatUpgradeRefusal(planGateReason(code, details), details.upgradeUrl);
-}
+const TEAM_UPGRADE_HINT = "Run `hq billing upgrade` to move to Team.";
 export class PlanGateError extends Error {
     code;
     details;
     constructor(code, details) {
-        super(formatPlanGateErrorText(code, details));
+        // Commands with their own expected-error boundary commonly print
+        // `err.message`. Keeping the friendly copy here means those boundaries
+        // retain the same plan-gate voice as main.ts without per-command handling.
+        super([formatPlanGateDetails(code, details), TEAM_UPGRADE_HINT].join("\n"));
         this.code = code;
         this.details = details;
         this.name = "PlanGateError";
@@ -159,53 +16,47 @@ export function isPlanGateError(err) {
     return err instanceof PlanGateError;
 }
 /** Plain, stable CLI copy for plan-gated resource creation. */
-export function formatPlanGateError(err, options = {}) {
-    return formatUpgradeRefusal(planGateReason(err.code, err.details), err.details.upgradeUrl, options);
+function formatPlanGateDetails(code, details) {
+    const existingResourcesNote = "Existing resources will keep working.";
+    if (code === "PLAN_LIMIT_EXCEEDED" &&
+        typeof details.resource === "string" &&
+        typeof details.used === "number" &&
+        typeof details.limit === "number") {
+        const upgrade = typeof details.upgradeUrl === "string"
+            ? `Upgrade to HQ Team ($500/mo) to remove limits: ${details.upgradeUrl}`
+            : "Upgrade to HQ Team ($500/mo) to remove limits.";
+        return [
+            `Free plan limit reached: ${details.resource} ${details.used}/${details.limit} used.`,
+            upgrade,
+            existingResourcesNote,
+        ].join("\n");
+    }
+    const upgrade = typeof details.upgradeUrl === "string"
+        ? `Upgrade to HQ Team ($500/mo) to remove limits: ${details.upgradeUrl}`
+        : "Upgrade to HQ Team ($500/mo) to remove limits.";
+    return [
+        "HQ Team plan required for this feature.",
+        upgrade,
+        existingResourcesNote,
+    ].join("\n");
+}
+export function formatPlanGateError(err) {
+    return [
+        formatPlanGateDetails(err.code, err.details),
+        TEAM_UPGRADE_HINT,
+    ].join("\n");
 }
 export function canOfferTeamUpgrade(argv = process.argv) {
     return Boolean(process.stdin.isTTY && process.stderr.isTTY) &&
         !process.env.CI &&
         !argv.includes("--json");
 }
-/** Ask before opening the exact URL returned by the server. */
-export async function offerUpgradeLink(url, deps = {}) {
-    const safeUrl = safeUpgradeUrl(url);
-    if (!safeUrl)
-        return false;
-    const cliLimitUrl = withCliLimitEntrySurface(safeUrl);
-    if (!(deps.interactive ?? canOfferTeamUpgrade(deps.argv)))
-        return false;
-    let answer;
-    if (deps.ask) {
-        answer = await deps.ask("Open upgrade link now? [y/N] ");
-    }
-    else {
-        const { createInterface } = await import("node:readline/promises");
-        const readline = createInterface({ input: process.stdin, output: process.stderr });
-        try {
-            answer = await readline.question("Open upgrade link now? [y/N] ");
-        }
-        finally {
-            readline.close();
-        }
-    }
-    if (!/^y(?:es)?$/i.test(answer.trim()))
-        return false;
-    if (deps.openUrl) {
-        await deps.openUrl(cliLimitUrl);
-    }
-    else {
-        const { default: open } = await import("open");
-        await open(cliLimitUrl);
-    }
-    return true;
-}
-/** Legacy checkout callback retained for callers outside the shared refusal paths. */
+/** Ask once, only on a real interactive terminal. */
 export async function offerTeamUpgrade(onConfirm, deps = {}) {
     if (!(deps.interactive ?? canOfferTeamUpgrade(deps.argv)))
         return false;
     if (deps.ask) {
-        const answer = await deps.ask("Upgrade now? (opens checkout) [y/N] ");
+        const answer = await deps.ask("Upgrade to HQ Team ($500/mo) now? [y/N] ");
         if (!/^y(?:es)?$/i.test(answer.trim()))
             return false;
         await onConfirm();
@@ -214,7 +65,7 @@ export async function offerTeamUpgrade(onConfirm, deps = {}) {
     const { createInterface } = await import("node:readline/promises");
     const readline = createInterface({ input: process.stdin, output: process.stderr });
     try {
-        const answer = await readline.question("Upgrade now? (opens checkout) [y/N] ");
+        const answer = await readline.question("Upgrade to HQ Team ($500/mo) now? [y/N] ");
         if (!/^y(?:es)?$/i.test(answer.trim()))
             return false;
         await onConfirm();
@@ -229,193 +80,19 @@ export function planGateErrorFromPayload(status, body, companyUid) {
     if (status !== 402 || !body || typeof body !== "object")
         return null;
     const payload = body;
-    // US-054: the personal feature denial. hq-pro identifies it with
-    // `error: "plan_feature_unavailable"` plus `scope: "personal"`; both the
-    // `scope` and `requiredPlan` fields are OPTIONAL on the wire, so an hq-pro
-    // that predates US-054 sends a company-shaped denial and keeps falling
-    // through to the company path below (defensive consumer).
-    if (payload.error === "plan_feature_unavailable" &&
-        payload.scope === "personal") {
-        const upgradeUrl = safeUpgradeUrl(payload.upgradeUrl);
-        return new PlanGateError("PERSONAL_PLAN_REQUIRED", {
-            ...(typeof payload.feature === "string"
-                ? { feature: payload.feature }
-                : {}),
-            ...(upgradeUrl ? { upgradeUrl } : {}),
-        });
-    }
-    const code = payload.code;
-    const upgradeUrl = safeUpgradeUrl(payload.upgradeUrl);
-    const targetCompanyUid = companyUid ?? companyUidFromPlanUpgradeUrl(upgradeUrl);
-    // Starter hard stops. The canonical body is `{ error: "plan_limit_reached",
-    // code: "PLAN_LIMIT_EXCEEDED", blocked, resources, message, fixOptions,
-    // freeMonth?, upgradeUrl }`; older servers send the body without `code`, the
-    // membership gate's legacy `{ code: "PLAN_LIMIT_EXCEEDED", resource, used,
-    // limit }`, or a personal presign row `{ code: "PLAN_LIMIT_REACHED" }`. All
-    // of them are the same refusal to the user, so they share one code.
-    if (payload.error === PLAN_LIMIT_REACHED_ERROR ||
-        code === "PLAN_LIMIT_EXCEEDED" ||
-        code === "PLAN_LIMIT_REACHED") {
-        return planLimitRefusalFromPayload(payload, upgradeUrl, targetCompanyUid);
-    }
-    const planLimit = payload.planLimit !== null &&
-        typeof payload.planLimit === "object" &&
-        !Array.isArray(payload.planLimit)
-        ? payload.planLimit
-        : undefined;
-    const isTeamPlanBillingRequired = code === "BILLING_REQUIRED" && planLimit?.requiredPlan === "team";
-    if (code === "BILLING_REQUIRED") {
-        if (!isTeamPlanBillingRequired ||
-            !targetCompanyUid ||
-            !/^cmp_[A-Za-z0-9_-]+$/.test(targetCompanyUid)) {
-            return null;
-        }
-    }
-    else if (code !== "PLAN_REQUIRED" &&
-        code !== "MEETING_PLAN_REQUIRED") {
+    if (payload.code !== "PLAN_LIMIT_EXCEEDED" && payload.code !== "PLAN_REQUIRED") {
         return null;
     }
-    const reason = typeof payload.message === "string"
-        ? payload.message
-        : typeof payload.error === "string" && payload.error !== payload.code
-            ? payload.error
-            : undefined;
-    return new PlanGateError(code, {
+    return new PlanGateError(payload.code, {
         ...(typeof payload.resource === "string" ? { resource: payload.resource } : {}),
-        ...(typeof payload.feature === "string" ? { feature: payload.feature } : {}),
         ...(typeof payload.used === "number" ? { used: payload.used } : {}),
         ...(typeof payload.limit === "number" ? { limit: payload.limit } : {}),
-        ...(upgradeUrl ? { upgradeUrl } : {}),
-        ...(reason ? { reason } : {}),
-        ...(targetCompanyUid ? { companyUid: targetCompanyUid } : {}),
-    });
-}
-/** Wire value of `error` on hq-pro's hard-stop 402 body. Never shown to users. */
-const PLAN_LIMIT_REACHED_ERROR = "plan_limit_reached";
-function finiteNonNegative(value) {
-    return typeof value === "number" && Number.isFinite(value) && value >= 0
-        ? value
-        : undefined;
-}
-function parseResources(value) {
-    if (!Array.isArray(value))
-        return undefined;
-    const rows = [];
-    for (const raw of value) {
-        if (!raw || typeof raw !== "object" || Array.isArray(raw))
-            continue;
-        const row = raw;
-        const used = finiteNonNegative(row.used);
-        const limit = finiteNonNegative(row.limit);
-        if (typeof row.resource !== "string" || used === undefined || limit === undefined) {
-            continue;
-        }
-        rows.push({ resource: row.resource, used, limit });
-    }
-    return rows.length > 0 ? rows : undefined;
-}
-function parseFixOptions(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return undefined;
-    const fix = {};
-    for (const [resource, target] of Object.entries(value)) {
-        const amount = finiteNonNegative(target);
-        if (amount !== undefined)
-            fix[resource] = amount;
-    }
-    return Object.keys(fix).length > 0 ? fix : undefined;
-}
-function planLimitRefusalFromPayload(payload, upgradeUrl, companyUid) {
-    // `message` is the customer sentence. A legacy `error` string is prose only
-    // when it is not a machine token (`plan_limit_reached`, or the code itself).
-    const reason = typeof payload.message === "string" && payload.message.trim()
-        ? payload.message
-        : typeof payload.error === "string" &&
-            payload.error.trim() &&
-            payload.error !== PLAN_LIMIT_REACHED_ERROR &&
-            payload.error !== payload.code
-            ? payload.error
-            : undefined;
-    const resources = parseResources(payload.resources);
-    const fixOptions = parseFixOptions(payload.fixOptions);
-    const parsedFreeMonth = parseFreeMonth(payload.freeMonth);
-    const freeMonthUrl = safeUpgradeUrl(parsedFreeMonth?.url);
-    const freeMonth = parsedFreeMonth
-        ? {
-            eligible: true,
-            ...(parsedFreeMonth.trialDays !== undefined
-                ? { trialDays: parsedFreeMonth.trialDays }
-                : {}),
-            ...(freeMonthUrl ? { url: freeMonthUrl } : {}),
-        }
-        : undefined;
-    const used = finiteNonNegative(payload.used);
-    const limit = finiteNonNegative(payload.limit);
-    return new PlanGateError("PLAN_LIMIT_EXCEEDED", {
-        ...(typeof payload.resource === "string" ? { resource: payload.resource } : {}),
-        ...(used !== undefined ? { used } : {}),
-        ...(limit !== undefined ? { limit } : {}),
-        ...(typeof payload.blocked === "string" ? { blocked: payload.blocked } : {}),
-        ...(resources ? { resources } : {}),
-        ...(fixOptions ? { fixOptions } : {}),
-        ...(freeMonth ? { freeMonth } : {}),
-        ...(upgradeUrl ? { upgradeUrl } : {}),
-        ...(reason ? { reason } : {}),
+        ...(typeof payload.upgradeUrl === "string" ? { upgradeUrl: payload.upgradeUrl } : {}),
         ...(companyUid ? { companyUid } : {}),
     });
 }
-/** Wire codes that mark a vault/sync error as a plan-limit refusal. */
-const PLAN_LIMIT_ERROR_CODES = new Set([
-    "PLAN_LIMIT_EXCEEDED",
-    "PLAN_LIMIT_REACHED",
-    PLAN_LIMIT_REACHED_ERROR,
-]);
-/**
- * Recognise a plan-limit refusal carried by an `@indigoai-us/hq-cloud`
- * `VaultClientError` (sync, share, skill upload). Duck-typed so hq-cli keeps
- * working across hq-cloud releases: the error exposes `statusCode`, `code`,
- * `upgradeUrl` and the raw response `body`. The raw body is decoded first so
- * the server's message, fix options and free month survive; a bare code (a
- * personal presign row has no body) still becomes a refusal with its link.
- */
-export function planGateErrorFromVaultError(err) {
-    if (isPlanGateError(err))
-        return err;
-    if (!err || typeof err !== "object")
-        return null;
-    const candidate = err;
-    const code = typeof candidate.code === "string" ? candidate.code : undefined;
-    const isPlanLimitCode = code !== undefined && PLAN_LIMIT_ERROR_CODES.has(code);
-    if (candidate.statusCode !== 402 && !isPlanLimitCode)
-        return null;
-    if (typeof candidate.body === "string" && candidate.body.trim()) {
-        try {
-            const decoded = planGateErrorFromPayload(402, JSON.parse(candidate.body));
-            if (decoded) {
-                if (!decoded.details.upgradeUrl) {
-                    const upgradeUrl = safeUpgradeUrl(candidate.upgradeUrl);
-                    if (upgradeUrl) {
-                        return new PlanGateError(decoded.code, { ...decoded.details, upgradeUrl });
-                    }
-                }
-                return decoded;
-            }
-        }
-        catch {
-            // Not JSON: fall through to the structured fields on the error itself.
-        }
-    }
-    if (!isPlanLimitCode)
-        return null;
-    return planLimitRefusalFromPayload({
-        code,
-        ...(typeof candidate.message === "string"
-            ? { error: candidate.message }
-            : {}),
-    }, safeUpgradeUrl(candidate.upgradeUrl), undefined);
-}
 /**
- * Decode the supported plan-gate envelopes. Malformed, unrelated,
+ * Decode only the two deliberate plan-gate envelopes. Malformed, unrelated,
  * or non-402 responses retain their existing command-specific handling.
  */
 export async function planGateErrorFromResponse(response, companyUid) {

package/dist/utils/qmd-model-download-error.d.ts

@@ -1,3 +1,11 @@
+/**
+ * The actionable remedy shown to the caller. Input-free — nothing is
+ * interpolated from the error, the argv, or qmd's output — so there is no
+ * injection surface. The disposition holds for every reading of a vanished
+ * `.ipull` partial (a concurrent finisher, a cache eviction, a partially-written
+ * file): it is transient and retryable, and re-running resumes the download.
+ */
+export declare const QMD_MODEL_DOWNLOAD_REMEDY: string;
 /**
  * True when `err` is a qmd interrupted-model-download failure: qmd's OWN captured
  * streams carry BOTH an ENOENT-rename signature AND a `.ipull` partial-download

package/dist/utils/qmd-model-download-error.js

@@ -50,7 +50,7 @@ const MODEL_FETCH_READS = new Set(["query", "vsearch", "embed"]);
  * `.ipull` partial (a concurrent finisher, a cache eviction, a partially-written
  * file): it is transient and retryable, and re-running resumes the download.
  */
-const QMD_MODEL_DOWNLOAD_REMEDY = "hq's local search couldn't finish downloading a model it needs: the partial " +
+export const QMD_MODEL_DOWNLOAD_REMEDY = "hq's local search couldn't finish downloading a model it needs: the partial " +
     "download file disappeared before it could be saved, which usually means " +
     "another hq or qmd process on this machine finished or cleared the same " +
     "download. Re-run the command — the download resumes.";

package/dist/utils/qmd-query-document-error.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The actionable remedy shown to the caller. Input-free: nothing is interpolated
+ * from the error, the argv, or qmd's output, so there is no injection surface —
+ * matching the bounded-fingerprint discipline of its siblings.
+ */
+export declare const QMD_QUERY_DOCUMENT_REMEDY: string;
 /**
  * True when `err` carries, in qmd's OWN captured streams, a query-document
  * syntax diagnostic — i.e. qmd's `query` parser rejected the positional as a

package/dist/utils/qmd-query-document-error.js

@@ -61,7 +61,7 @@ const QUERY_DOCUMENT_READS = new Set(["query"]);
  * from the error, the argv, or qmd's output, so there is no injection surface —
  * matching the bounded-fingerprint discipline of its siblings.
  */
-const QMD_QUERY_DOCUMENT_REMEDY = "Hybrid search was given a multi-line query, and qmd read it as a structured " +
+export const QMD_QUERY_DOCUMENT_REMEDY = "Hybrid search was given a multi-line query, and qmd read it as a structured " +
     "query document whose lines must each begin with a lex:, vec:, hyde:, or " +
     "intent: prefix. Put your search terms on a single line, or prefix every line, " +
     "then run the command again.";

package/dist/utils/redact-error-text.js

@@ -9,7 +9,6 @@
 // expected branch instead, which prints `err.message` verbatim. Rather than
 // duplicate the chain at the second print site, it lives here and both callers
 // share it: provider-minted text is untrusted and must never be printed raw.
-import { redactUrlsInText } from "./redact-url.js";
 /** Upper bound on any redacted diagnostic — a message, not a payload dump. */
 export const REDACTED_TEXT_MAX_LENGTH = 1_000;
 /**
@@ -19,7 +18,7 @@ export const REDACTED_TEXT_MAX_LENGTH = 1_000;
  * their own fallback wording.
  */
 export function redactErrorText(text) {
-    return redactUrlsInText(text)
+    return text
         .replace(/-----BEGIN[^-]+PRIVATE KEY-----[\s\S]*?-----END[^-]+PRIVATE KEY-----/g, "[REDACTED]")
         .replace(/\p{Cc}/gu, " ")
         .replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "[REDACTED]")

package/dist/utils/run-bundled-script.d.ts

@@ -50,16 +50,10 @@ export type RunBundledScriptOptions = {
     hqRoot?: string;
     /** Extra environment for the child, applied last. */
     env?: Record<string, string | undefined>;
-    /** Capture stdout and stderr as bytes instead of inheriting those streams. */
-    captureOutput?: boolean;
 };
 export type RunBundledScriptResult = {
     /** The child's exit code, or 128+signal if it was terminated by one. */
     code: number;
-    /** Present when captureOutput is true. */
-    stdout?: Buffer;
-    /** Present when captureOutput is true. */
-    stderr?: Buffer;
 };
 /**
  * Execute a bundled scaffold script and return its exit code.