@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/commands/cloud-provision.js

@@ -32,27 +32,8 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
 import { parseUserYaml } from "../utils/user-yaml-error.js";
-import { createSyncProgressRecorder, share, } from "@indigoai-us/hq-cloud";
+import { share } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
-const SHARED_COMPANY_STARTER_PATHS = [
-    "README.md",
-    "board.json",
-    "knowledge/README.md",
-    "knowledge/design-styles/packs/.gitkeep",
-    "people/.gitkeep",
-    "policies/.gitkeep",
-    "projects/.gitkeep",
-    "repos/.gitkeep",
-    "skills/.gitkeep",
-    "sources/meetings/source.yaml",
-    "workspace/.gitignore",
-    "workspace/index.jsonl",
-    "workspace/sessions/.gitkeep",
-];
-function hasLocalSharedStarterPath(hqRoot, slug) {
-    const companyDir = path.join(hqRoot, "companies", slug);
-    return SHARED_COMPANY_STARTER_PATHS.some((relativePath) => fs.existsSync(path.join(companyDir, relativePath)));
-}
 /** Custom error class so the CLI runner can map to exit codes. */
 export class ProvisionError extends Error {
     code;
@@ -285,21 +266,6 @@ export function writeCompanyConfig(hqRoot, slug, config) {
     return true;
 }
 // ── Vault HTTP client (real impl) ────────────────────────────────────────────
-const VAULT_REQUEST_TIMEOUT_MS = 15_000;
-/** Run a complete Vault HTTP operation under a finite deadline. */
-async function withVaultRequest(url, init, readResponse) {
-    const deadline = AbortSignal.timeout(VAULT_REQUEST_TIMEOUT_MS);
-    try {
-        const res = await fetch(url, { ...init, signal: deadline });
-        return await readResponse(res);
-    }
-    catch (err) {
-        if (deadline.aborted) {
-            throw new ProvisionError(1, `Vault request timed out after ${VAULT_REQUEST_TIMEOUT_MS}ms`);
-        }
-        throw err;
-    }
-}
 /**
  * Default vault HTTP client backed by global `fetch`. Uses the `/v1/entities`
  * route surface (matches AppBar `vault_client.rs` and hq-pro handler routes).
@@ -318,60 +284,52 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
     return {
         async listMyPersonEntities() {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/by-type/person`;
-            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
-                if (res.status === 404)
-                    return [];
-                if (!res.ok) {
-                    const body = await safeBody(res);
-                    throw new ProvisionError(1, `Vault GET /entity/by-type/person failed: ${res.status} ${res.statusText} — ${body}`);
-                }
-                const data = (await res.json());
-                return data.entities ?? [];
-            });
+            const res = await fetch(url, { method: "GET", headers });
+            if (res.status === 404)
+                return [];
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/by-type/person failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            const data = (await res.json());
+            return data.entities ?? [];
         },
         async findCompanyBySlug(slug) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/by-slug/company/${encodeURIComponent(slug)}`;
-            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
-                if (res.status === 404)
-                    return null;
-                if (!res.ok) {
-                    const body = await safeBody(res);
-                    throw new ProvisionError(1, `Vault GET by-slug failed: ${res.status} ${res.statusText} — ${body}`);
-                }
-                const data = (await res.json());
-                if (!data.entity) {
-                    throw new ProvisionError(1, `Vault GET by-slug returned 200 with no entity body`);
-                }
-                return data.entity;
-            });
+            const res = await fetch(url, { method: "GET", headers });
+            if (res.status === 404)
+                return null;
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET by-slug failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            const data = (await res.json());
+            if (!data.entity) {
+                throw new ProvisionError(1, `Vault GET by-slug returned 200 with no entity body`);
+            }
+            return data.entity;
         },
         async checkSlugInMyNamespace(slug) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/check-slug/me?type=company&slug=${encodeURIComponent(slug)}`;
-            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
-                if (!res.ok) {
-                    const body = await safeBody(res);
-                    throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
-                }
-                const data = (await res.json());
-                return {
-                    ...data,
-                    skipStarterSeedSupported: data.skipStarterSeedSupported === true,
-                };
-            });
+            const res = await fetch(url, { method: "GET", headers });
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            return (await res.json());
         },
         async getCompanyByUid(uid) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
-            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
-                if (!res.ok) {
-                    const body = await safeBody(res);
-                    throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-                }
-                const data = (await res.json());
-                if (!data.entity) {
-                    throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
-                }
-                return data.entity;
-            });
+            const res = await fetch(url, { method: "GET", headers });
+            if (!res.ok) {
+                const body = await safeBody(res);
+                throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+            }
+            const data = (await res.json());
+            if (!data.entity) {
+                throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
+            }
+            return data.entity;
         },
         async createCompanyEntity(input) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity`;
@@ -382,58 +340,29 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             };
             if (input.ownerUid)
                 body.ownerUid = input.ownerUid;
-            if (input.skipStarterSeed)
-                body.skipStarterSeed = true;
-            return withVaultRequest(url, {
+            const res = await fetch(url, {
                 method: "POST",
                 headers,
                 body: JSON.stringify(body),
-            }, async (res) => {
-                if (!res.ok) {
-                    const text = await safeBody(res);
-                    // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
-                    // in their namespace (owned ∪ active-member-of). Under the
-                    // per-user-namespace model this is the new same-user-collision
-                    // signal — distinct from the legacy global EntityAlreadyExists.
-                    // The CLI normally reaches `createCompanyEntity` only after
-                    // `checkSlugInMyNamespace` reported `available: true`, so a
-                    // 409 here means a race between the pre-check and the POST.
-                    // Surface the response body verbatim so the caller can see the
-                    // `code` + `conflictingCompanyUid` and resolve / retry.
-                    throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
-                }
-                const data = (await res.json());
-                if (!data.entity) {
-                    throw new ProvisionError(1, `Vault POST /entity returned ${res.status} with no entity body`);
-                }
-                return data.entity;
-            });
-        },
-        async softDeleteCompany(uid) {
-            const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
-            return withVaultRequest(url, { method: "DELETE", headers }, async (res) => {
-                if (res.status === 403) {
-                    const body = await safeBody(res);
-                    throw new ProvisionError(2, `Refusing to retire '${uid}': only the company owner can soft-tombstone it. ${body}`);
-                }
-                if (res.status === 404) {
-                    const body = await safeBody(res);
-                    throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: not found — ${body}`);
-                }
-                if (res.status === 400) {
-                    const body = await safeBody(res);
-                    throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-                }
-                if (!res.ok) {
-                    const body = await safeBody(res);
-                    throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-                }
-                const data = (await res.json());
-                if (data.deleted !== true || typeof data.uid !== "string") {
-                    throw new ProvisionError(1, `Vault DELETE /entity/${uid} returned ${res.status} with no deleted confirmation`);
-                }
-                return { deleted: true, uid: data.uid };
             });
+            if (!res.ok) {
+                const text = await safeBody(res);
+                // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
+                // in their namespace (owned ∪ active-member-of). Under the
+                // per-user-namespace model this is the new same-user-collision
+                // signal — distinct from the legacy global EntityAlreadyExists.
+                // The CLI normally reaches `createCompanyEntity` only after
+                // `checkSlugInMyNamespace` reported `available: true`, so a
+                // 409 here means a race between the pre-check and the POST.
+                // Surface the response body verbatim so the caller can see the
+                // `code` + `conflictingCompanyUid` and resolve / retry.
+                throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
+            }
+            const data = (await res.json());
+            if (!data.entity) {
+                throw new ProvisionError(1, `Vault POST /entity returned ${res.status} with no entity body`);
+            }
+            return data.entity;
         },
     };
 }
@@ -446,32 +375,7 @@ async function safeBody(res) {
     }
 }
 // ── Default initial-sync runner (wraps share()) ──────────────────────────────
-const INITIAL_SYNC_ERROR_FIELD_LIMIT = 240;
-function truncateInitialSyncErrorField(value) {
-    return value.length <= INITIAL_SYNC_ERROR_FIELD_LIMIT
-        ? value
-        : `${value.slice(0, INITIAL_SYNC_ERROR_FIELD_LIMIT - 1)}…`;
-}
-class InitialSyncUploadFailureError extends Error {
-    filesUploaded;
-    constructor(filesUploaded, failureCount, firstFailure) {
-        const detail = `${truncateInitialSyncErrorField(firstFailure.path)}: ` +
-            truncateInitialSyncErrorField(firstFailure.message);
-        const failureLabel = failureCount === 1
-            ? "upload failure"
-            : "upload failures";
-        super(`${failureCount} ${failureLabel}; first failure: ${detail}`);
-        this.filesUploaded = filesUploaded;
-        this.name = "InitialSyncUploadFailureError";
-    }
-}
 async function defaultRunInitialSync(args) {
-    let failureCount = 0;
-    let firstFailure;
-    const recordProgress = createSyncProgressRecorder({
-        company: args.slug,
-        phase: "push",
-    });
     const result = await share({
         paths: [companyDirPath(args.hqRoot, args.slug)],
         company: args.slug,
@@ -479,25 +383,7 @@ async function defaultRunInitialSync(args) {
         onConflict: "keep",
         vaultConfig: buildVaultConfig(args.accessToken),
         hqRoot: args.hqRoot,
-        progressRecorder: (event) => {
-            recordProgress(event);
-            if (event.type === "plan-limit") {
-                failureCount += Math.max(1, event.count ?? 0, event.paths?.length ?? 0);
-                firstFailure ??= {
-                    path: event.paths?.[0] ?? "plan limit",
-                    message: event.message ?? "plan limit refused upload",
-                };
-                return;
-            }
-            if (event.type !== "error" || event.diagnostic === true)
-                return;
-            failureCount++;
-            firstFailure ??= { path: event.path, message: event.message };
-        },
     });
-    if (failureCount > 0 && firstFailure) {
-        throw new InitialSyncUploadFailureError(result.filesUploaded, failureCount, firstFailure);
-    }
     return {
         filesUploaded: result.filesUploaded,
         bytesUploaded: result.bytesUploaded,
@@ -573,7 +459,6 @@ export async function provisionCompany(options) {
     // match the caller's own person UID(s) from `listMyPersonEntities`.
     const callerOwnedUids = new Set(persons.map((p) => p.uid));
     const callerIsOwner = !options.ownerUid || callerOwnedUids.has(options.ownerUid);
-    const hasLocalSharedStarterFiles = hasLocalSharedStarterPath(options.hqRoot, options.slug);
     let entity;
     let createdEntity = false;
     if (callerIsOwner) {
@@ -583,24 +468,17 @@ export async function provisionCompany(options) {
             entity = await vaultClient.getCompanyByUid(slugCheck.conflictingCompanyUid);
         }
         else {
-            if (hasLocalSharedStarterFiles && !slugCheck.skipStarterSeedSupported) {
-                throw new ProvisionError(1, "This hq-pro server does not support preserving local starter files during cloud provisioning; update hq-pro and retry");
-            }
             log(`slug available in caller's namespace — creating vault entity`);
             entity = await vaultClient.createCompanyEntity({
                 slug: options.slug,
                 name: options.name ?? options.slug,
                 ownerUid: options.ownerUid,
-                ...(hasLocalSharedStarterFiles ? { skipStarterSeed: true } : {}),
             });
             createdEntity = true;
             log(`created vault entity uid=${entity.uid}`);
         }
     }
     else {
-        if (hasLocalSharedStarterFiles) {
-            throw new ProvisionError(1, "Cannot preserve local starter files when provisioning for a different owner");
-        }
         log(`--owner ${options.ownerUid} differs from caller's person(s); skipping namespace pre-check (server authoritatively gates per-target-namespace)`);
         entity = await vaultClient.createCompanyEntity({
             slug: options.slug,
@@ -610,52 +488,6 @@ export async function provisionCompany(options) {
         createdEntity = true;
         log(`created vault entity uid=${entity.uid}`);
     }
-    // hq-pro auto-suffixes a company slug when another owner already holds the
-    // bare name (`<slug>-<ownerTag>`). `/entity/check-slug/me` only looks at the
-    // caller's namespace, so it reports "available" and we POST; the server then
-    // returns a different slug. Writing companies/<requested>/.hq/config.json
-    // with the requested slug (or syncing with --company <assigned>) leaves the
-    // local folder and the cloud slug pointing at two different paths — share()
-    // derives syncRoot from ctx.slug, so the company can never be pushed.
-    // Fail before any local write. Retire a just-created entity so we do not
-    // leave a suffixed orphan.
-    if (entity.slug !== options.slug) {
-        const assigned = entity.slug || "(missing)";
-        let retired = false;
-        if (createdEntity) {
-            try {
-                await vaultClient.softDeleteCompany(entity.uid);
-                retired = true;
-                log(`retired vault entity uid=${entity.uid} — assigned slug ${assigned} differs from requested ${options.slug}`);
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(`failed to retire mismatched vault entity uid=${entity.uid}: ${msg}`);
-            }
-        }
-        const retireNote = retired
-            ? `The just-created entity ${entity.uid} was retired.`
-            : createdEntity
-                ? `Retire entity ${entity.uid} with \`hq cloud retire company\`, then retry after the original slug is free.`
-                : `Existing entity ${entity.uid} was not modified.`;
-        throw new ProvisionError(1, `Cloud assigned slug "${assigned}" instead of requested "${options.slug}". ` +
-            `Local folder is companies/${options.slug}; sync derives the company folder from the cloud slug, so this company cannot be pushed. ` +
-            `${retireNote} Ask an admin to release the original slug, or rename the local folder to "${assigned}" and re-run.`, {
-            ok: false,
-            company_slug: options.slug,
-            cloud_uid: entity.uid,
-            bucket_name: entity.bucketName ?? "",
-            vault_api_url: options.vaultApiUrl,
-            kms_key_id: entity.kmsKeyId ?? null,
-            created_entity: createdEntity,
-            manifest_patched: false,
-            config_written: false,
-            initial_sync: {
-                ok: false,
-                error: `assigned slug "${assigned}" differs from requested "${options.slug}"`,
-            },
-        });
-    }
     if (!entity.bucketName) {
         // Vault returned an entity without a bucket — this would happen if the
         // provisioning Lambda asynchronously failed. We have a `cloud_uid` but
@@ -730,13 +562,7 @@ export async function provisionCompany(options) {
                 created_entity: createdEntity,
                 manifest_patched: true,
                 config_written: true,
-                initial_sync: {
-                    ok: false,
-                    error: msg,
-                    ...(err instanceof InitialSyncUploadFailureError
-                        ? { files_uploaded: err.filesUploaded }
-                        : {}),
-                },
+                initial_sync: { ok: false, error: msg },
             });
         }
     }

package/dist/commands/cloud.d.ts

@@ -13,9 +13,8 @@
  *   hq sync status            — show local journal summary
  */
 import { Command } from "commander";
-import { type ConflictStrategy, type EntityContext, type MembershipSyncConfig, type SyncMode, type PullScope, type ExplicitGrant, type ShareOptions, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
+import { type ConflictStrategy, type MembershipSyncConfig, type SyncMode, type PullScope, type ExplicitGrant } from "@indigoai-us/hq-cloud";
 import { type BannerLevel } from "../lib/narrow-hint-banner.js";
-import { type PlanLimitRefusalSummary } from "../lib/billing/plan-limit-refusals.js";
 /**
  * Terminal-failure signal for the sync fanout runners. The runners
  * (`runPushAll` / `runPullAll` / `runPullPersonal` / `runNowSingle` /
@@ -29,16 +28,7 @@ import { type PlanLimitRefusalSummary } from "../lib/billing/plan-limit-refusals
  */
 export declare class SyncExitError extends Error {
     readonly code: number;
-    /**
-     * The client-health outcome to record for this exit. A run whose only
-     * problem was a plan-limit refusal exits non-zero (it did not upload what
-     * was asked) but is not a sync failure: the engine worked and the refusal
-     * is plan state, so it must not count toward `consecutiveFailures`.
-     */
-    readonly health: "failed" | "succeeded";
-    constructor(code: number, opts?: {
-        health?: "failed" | "succeeded";
-    });
+    constructor(code: number);
 }
 /**
  * Preserve the vault's typed write-scope refusal at the CLI boundary. This is
@@ -71,14 +61,6 @@ export declare function scopeExcludedWarning(count: number): string | null;
  * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
  */
 export declare function scopeExcludedPrefixDetail(prefixSet: readonly string[] | undefined): string | null;
-/**
- * Every warning line for a push that dropped files, shared by `push`, `now`
- * and `push --all`. With a client prefix scope the files fell outside the
- * caller's write prefixes; without one (prefixSet undefined) the server
- * refused them path by path — typically another member's child in a private
- * folder foo/ — and grant advice would point the reader the wrong way.
- */
-export declare function scopeExcludedLines(count: number, prefixSet: readonly string[] | undefined): string[];
 /**
  * Bound foreground waits for a watcher/manual sync that currently owns the
  * per-root operation lock. The cloud engine reads this environment value on
@@ -207,12 +189,6 @@ export interface PullAllRow {
 }
 export interface ShareCallOptions {
     company: string;
-    /**
-     * The target's display slug, or undefined for the personal vault. Labels the
-     * shared progress snapshot and builds the company billing link for a
-     * plan-limit refusal that arrived without one.
-     */
-    targetSlug?: string;
     hqRoot: string;
     paths: string[];
     onConflict?: ConflictStrategy;
@@ -233,8 +209,6 @@ export interface ShareCallResult {
     filesExcludedByScope: number;
     conflictPaths: string[];
     aborted: boolean;
-    /** Files this leg's plan limit refused; absent or null when none were. */
-    planLimit?: PlanLimitRefusalSummary | null;
 }
 export interface PushAllDeps {
     vaultClient: PullAllVaultClient;
@@ -257,8 +231,6 @@ export interface PushAllOptions {
 export interface PushAllRow {
     slug: string;
     result?: ShareCallResult;
-    /** Client write-prefix scope this push ran under; undefined = none applied. */
-    prefixSet?: readonly string[];
     error?: string;
 }
 export interface PushAllResult {
@@ -292,18 +264,6 @@ export declare function pullAll(options: PullAllOptions, deps: PullAllDeps): Pro
  * deps so tests can drive it without network or filesystem.
  */
 export declare function pushAll(options: PushAllOptions, deps: PushAllDeps): Promise<PushAllResult>;
-/**
- * Credentials `hq sync push` hands to share(). A pre-vended EntityContext
- * (AppBar's `--creds-from-stdin` first push) cannot write under private
- * folders directly, so it travels with the caller's vault config as
- * `privateFolderVaultConfig`. share() takes exactly one of `vaultConfig` /
- * `entityContext`.
- */
-export declare function pushShareCredentials(input: {
-    entityContext?: EntityContext;
-    vaultConfig?: VaultServiceConfig;
-    scopeVaultConfig?: VaultServiceConfig;
-}): Pick<ShareOptions, "entityContext" | "vaultConfig" | "privateFolderVaultConfig">;
 /**
  * Resolve the canonical person entity UID for the logged-in user. Used by
  * `hq sync {push,pull,now} --personal` to target the personal vault without
@@ -312,16 +272,22 @@ export declare function pushShareCredentials(input: {
  */
 export declare function resolveCanonicalPersonUid(vaultClient: PullAllVaultClient): Promise<string>;
 /**
- * Keep `hq sync push --personal <path>` refused by default. Positional paths
- * bypass `computePersonalVaultPaths` and can send excluded `companies/`,
- * `repos/`, `workspace/`, or `.git/` content to the personal vault. The
- * default-off targeted-paths gate allows the combination only after every
- * path is realpath-normalized and checked against the computed personal scope
- * and its file exclusions. Closes hq-cli#25.
+ * Refuse `hq sync push --personal <path>` — the combination silently
+ * bypasses `PERSONAL_VAULT_EXCLUDED_TOP_LEVEL` (which is only applied by
+ * `computePersonalVaultPaths`), risking cross-scope upload of `companies/`,
+ * `repos/`, `workspace/`, or `.git/` content to the personal vault. Real
+ * incident (2026-05-21): a single command uploaded 196 `companies/{slug}/**`
+ * objects to a personal vault before being killed. Cleanup required a
+ * hand-rolled S3 sweep. Closes hq-cli#25.
+ *
+ * Refusal — not silent filtering — is intentional: explicit is better than
+ * implicit guesswork, and the legitimate "I want to push a subset of my
+ * personal vault" use case has a clean workaround (drop `--personal`, the
+ * subset upload targets the active company via standard semantics).
  */
 export declare function assertNoPersonalPositionalPaths(opts: {
     personal?: boolean;
-}, paths: string[] | undefined, targetedPersonalPathsEnabled?: boolean): void;
+}, paths: string[] | undefined): void;
 /**
  * Refuse ambiguous selector combinations. `--all`, `--personal`, and
  * `--company` are mutually exclusive — at most one may be set per