@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/utils/environmental-error.d.ts

@@ -7,22 +7,4 @@
  * result means "this is a normal error; handle it as usual (capture to Sentry)".
  */
 export declare function environmentalFsErrorMessage(err: unknown): string | null;
-export type FilesystemErrorCaptureContext = {
-    fingerprint: ["fs-error", string, string, string];
-    tags: Record<string, string>;
-    extra: {
-        fs_path: string;
-        fs_reason: string;
-    };
-};
-/** Return only the registered command path, never positional user data. */
-export declare function hqCommand(argv?: readonly string[]): string;
-/**
- * Build stable Sentry context for known OS filesystem refusals. The failure is
- * intentionally still captured: this is instrumentation for the OneDrive /
- * antivirus / path-length hypotheses, not an expected-error suppression.
- */
-export declare function filesystemErrorCaptureContext(err: unknown, argv?: readonly string[]): FilesystemErrorCaptureContext | null;
-/** Plain operator guidance for a captured filesystem failure. */
-export declare function filesystemErrorMessage(err: unknown): string | null;
 //# sourceMappingURL=environmental-error.d.ts.map

package/dist/utils/environmental-error.js

@@ -1,20 +1,16 @@
 // src/utils/environmental-error.ts
 //
 // Classify errors that stem from the user's machine/filesystem state rather
-// than an HQ code defect. Full-disk conditions have a known remedy and remain
-// quiet; permission and file-lock conditions remain captured with bounded
-// attribution so the next occurrence can identify the real cause.
+// than an HQ code defect. These are unactionable from our side: a full disk, an
+// exhausted quota, or a read-only filesystem. The CLI surfaces a clear,
+// actionable message and does NOT report them to Sentry — otherwise a single
+// full disk floods the issue tracker with identical, unfixable crash reports.
 //
 // HQ-CLI-2: `hq reindex` hit ENOSPC in the operation-lock temp-file write
 // (`fs.openSync` → "ENOSPC: no space left on device, open") and the raw error
 // propagated uncaught to the CLI's top-level handler, which captured it to
 // Sentry and exited silently — 5 stack-trace crashes in 6 seconds, with no
 // message telling the user their disk was full.
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { COMMAND_CATALOG } from "../command-catalog.generated.js";
-import { CLI_VERSION } from "../cli-version.js";
-import { redactErrorText } from "./redact-error-text.js";
 /**
  * Node errno codes for "the filesystem cannot accept this write" — purely
  * environmental, never a code bug. Mapped to the message shown to the user.
@@ -24,24 +20,6 @@ const ENVIRONMENTAL_FS_CODES = {
     EDQUOT: "Disk quota exceeded. Free up space (or raise your quota) and try again.",
     EROFS: "The filesystem is read-only, so HQ can't write here. Check the mount/permissions and try again.",
 };
-const MAX_CAUSE_DEPTH = 4;
-function errorRecord(value) {
-    return value !== null && typeof value === "object" ? value : null;
-}
-function findErrorWithCode(err, codes) {
-    const seen = new Set();
-    let current = err;
-    for (let depth = 0; depth <= MAX_CAUSE_DEPTH; depth += 1) {
-        const record = errorRecord(current);
-        if (!record || seen.has(record))
-            return null;
-        seen.add(record);
-        if (typeof record.code === "string" && codes.has(record.code))
-            return record;
-        current = record.cause;
-    }
-    return null;
-}
 /**
  * If `err` is an environmental disk/quota/read-only filesystem error, return a
  * short, user-facing message explaining it; otherwise return `null`.
@@ -51,220 +29,9 @@ function findErrorWithCode(err, codes) {
  * result means "this is a normal error; handle it as usual (capture to Sentry)".
  */
 export function environmentalFsErrorMessage(err) {
-    const record = findErrorWithCode(err, new Set(Object.keys(ENVIRONMENTAL_FS_CODES)));
-    return record && typeof record.code === "string"
-        ? ENVIRONMENTAL_FS_CODES[record.code] ?? null
-        : null;
-}
-const CAPTURED_FS_CODES = new Set(["EPERM", "EACCES", "EBUSY", "UNKNOWN"]);
-const CAPTURED_FS_SYSCALLS = new Set(["open", "symlink", "rename", "unlink"]);
-function stringField(value) {
-    return typeof value === "string" && value.length > 0 ? value : null;
-}
-function pathFromMessage(message, syscall) {
-    const text = stringField(message);
-    if (!text)
-        return null;
-    const escapedSyscall = syscall.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const match = new RegExp(`${escapedSyscall}\\s+['"]([^'"]+)['"]`, "i").exec(text);
-    return match?.[1] ?? null;
-}
-function findFilesystemError(err) {
-    const seen = new Set();
-    let current = err;
-    for (let depth = 0; depth <= MAX_CAUSE_DEPTH; depth += 1) {
-        const record = errorRecord(current);
-        if (!record || seen.has(record))
-            return null;
-        seen.add(record);
-        const code = stringField(record.code);
-        const syscall = stringField(record.syscall);
-        if (code && syscall && CAPTURED_FS_CODES.has(code) && CAPTURED_FS_SYSCALLS.has(syscall)) {
-            const rawPath = stringField(record.path) ??
-                stringField(record.dest) ??
-                pathFromMessage(record.message, syscall) ??
-                "unknown";
-            return { record, code, syscall, rawPath };
-        }
-        current = record.cause;
-    }
-    return null;
-}
-function canonicalPath(rawPath) {
-    if (rawPath === "unknown")
-        return "";
-    const resolved = path.resolve(rawPath);
-    try {
-        return path.normalize(requireRealpath(resolved));
-    }
-    catch {
-        // The failed path may not exist. Resolving its parent still canonicalizes
-        // symlinked HQ roots without turning missing-file attribution into a throw.
-        const parent = path.dirname(resolved);
-        try {
-            return path.join(requireRealpath(parent), path.basename(resolved));
-        }
-        catch {
-            return resolved;
-        }
-    }
-}
-function requireRealpath(candidate) {
-    // Keep the filesystem read behind one tiny seam so the classifier remains
-    // safe when the failed target has already disappeared.
-    return fs.realpathSync.native(candidate);
-}
-function pathSegments(value) {
-    return value
-        .replaceAll("\\", "/")
-        .split("/")
-        .filter(Boolean)
-        .map((segment) => segment.toLowerCase());
-}
-function pathKind(rawPath, resolvedPath) {
-    if (rawPath === "unknown")
-        return "other";
-    const segments = pathSegments(`${resolvedPath}/${rawPath}`);
-    if (segments.includes("node_modules") || segments.includes(".pnpm"))
-        return "install-tree";
-    if (segments.includes("worktree") || segments.includes("worktrees"))
-        return "worktree";
-    if (segments.includes("companies"))
-        return "companies";
-    if (segments.includes("workspace"))
-        return "workspace";
-    if (segments.includes("hq"))
-        return "hq-root";
-    return "other";
-}
-function syncedFolder(resolvedPath) {
-    if (!resolvedPath)
-        return "none";
-    const segments = pathSegments(resolvedPath);
-    // iCloud is identified from canonical path components, not a display-name
-    // substring: Desktop/Documents aliases can point into this container.
-    for (let i = 0; i + 1 < segments.length; i += 1) {
-        if (segments[i] === "library" && segments[i + 1] === "mobile documents")
-            return "icloud";
-    }
-    if (segments.some((segment) => segment === "onedrive" || segment.startsWith("onedrive -")))
-        return "onedrive";
-    if (segments.includes("dropbox"))
-        return "dropbox";
-    if (segments.some((segment) => segment === "google drive" || segment === "google-drive" || segment === "googledrive")) {
-        return "google-drive";
-    }
-    return "none";
-}
-function redactedPath(rawPath) {
-    if (rawPath === "unknown")
-        return "unknown";
-    const segments = rawPath.replaceAll("\\", "/").split("/").filter(Boolean);
-    const tail = segments.slice(-2).join("/");
-    return redactErrorText(tail) || "unknown";
-}
-function fileAttributes(record, rawPath) {
-    const metadata = [record.fileAttributes, record.attributes]
-        .map(stringField)
-        .filter((value) => value !== null)
-        .join(" ")
-        .toLowerCase();
-    if (metadata.includes("offline") || record.offline === true)
-        return "offline";
-    if (metadata.includes("readonly") || metadata.includes("read-only") || record.readonly === true)
-        return "readonly";
-    const leaf = rawPath.replaceAll("\\", "/").split("/").filter(Boolean).at(-1) ?? rawPath;
-    if (metadata.includes("hidden") || record.hidden === true || leaf.startsWith("."))
-        return "hidden";
-    return "none";
-}
-function findRegisteredCommand(commands, token) {
-    return commands.find((command) => command.name === token || command.aliases.includes(token)) ?? null;
-}
-function optionTakesValue(command, token) {
-    const optionName = token.split("=", 1)[0];
-    return command.options.some((option) => {
-        const names = option.flags
-            .split(",")
-            .map((flag) => flag.trim().split(/\s+/, 1)[0])
-            .filter((name) => Boolean(name));
-        return names.includes(optionName) && /(?:<[^>]+>|\[[^\]]+\])/.test(option.flags);
-    });
-}
-/** Return only the registered command path, never positional user data. */
-export function hqCommand(argv = process.argv) {
-    const commandPath = [];
-    let commands = COMMAND_CATALOG;
-    let currentCommand = null;
-    for (let index = 2; index < argv.length; index += 1) {
-        const token = argv[index];
-        if (!token || token === "--")
-            break;
-        if (token.startsWith("-")) {
-            if (!token.includes("=") && currentCommand && optionTakesValue(currentCommand, token)) {
-                index += 1;
-            }
-            continue;
-        }
-        const command = findRegisteredCommand(commands, token);
-        if (!command)
-            break;
-        commandPath.push(command.name);
-        currentCommand = command;
-        commands = command.subcommands;
-    }
-    return commandPath.join(" ") || "unknown";
-}
-function pathLengthBucket(rawPath) {
-    if (rawPath.length < 200)
-        return "<200";
-    if (rawPath.length <= 260)
-        return "200-260";
-    return ">260";
-}
-/**
- * Build stable Sentry context for known OS filesystem refusals. The failure is
- * intentionally still captured: this is instrumentation for the OneDrive /
- * antivirus / path-length hypotheses, not an expected-error suppression.
- */
-export function filesystemErrorCaptureContext(err, argv = process.argv) {
-    const details = findFilesystemError(err);
-    if (!details)
-        return null;
-    const resolvedPath = canonicalPath(details.rawPath);
-    const safePath = redactedPath(details.rawPath);
-    const command = hqCommand(argv);
-    return {
-        fingerprint: ["fs-error", details.code, details.syscall, command],
-        tags: {
-            fs_code: details.code,
-            fs_syscall: details.syscall,
-            path_kind: pathKind(details.rawPath, resolvedPath),
-            synced_folder: syncedFolder(resolvedPath),
-            path_len_bucket: pathLengthBucket(details.rawPath),
-            file_attributes: fileAttributes(details.record, details.rawPath),
-            hq_command: command,
-            platform: process.platform,
-            hq_cli_version: CLI_VERSION,
-        },
-        extra: {
-            fs_path: safePath,
-            fs_reason: redactErrorText(`${details.code} ${details.syscall} failed at ${safePath}`),
-        },
-    };
-}
-/** Plain operator guidance for a captured filesystem failure. */
-export function filesystemErrorMessage(err) {
-    const details = findFilesystemError(err);
-    if (!details)
+    const code = err?.code;
+    if (typeof code !== "string")
         return null;
-    const resolvedPath = canonicalPath(details.rawPath);
-    const safePath = redactedPath(details.rawPath);
-    const synced = syncedFolder(resolvedPath);
-    const permissionDenied = details.code === "EACCES" || details.code === "EPERM";
-    const remedy = permissionDenied && process.platform !== "win32" && synced === "none"
-        ? "Check file and folder permissions, close the file, then retry."
-        : "Close the file or exclude its folder from cloud sync; if it persists, check permissions, then retry.";
-    return `Filesystem operation ${details.syscall} failed (${details.code}) at ${safePath}. ${remedy}`;
+    return ENVIRONMENTAL_FS_CODES[code] ?? null;
 }
 //# sourceMappingURL=environmental-error.js.map

package/dist/utils/expected-cli-error.d.ts

@@ -5,8 +5,6 @@
 export interface ExpectedUserError extends Error {
     expected: true;
 }
-/** Stamp an existing Error with the boundary's caller-owned disposition. */
-export declare function markExpectedUserError<T extends Error>(err: T): T & ExpectedUserError;
 /**
  * True when `err` is an Error explicitly marked `expected === true`. A non-null
  * result means the top-level handler should print `err.message` and skip Sentry

package/dist/utils/expected-cli-error.js

@@ -16,10 +16,6 @@
 // ("Only a company owner can approve or reject queued integration writes"); the
 // thrown error propagated to the top-level handler, which captured it to Sentry
 // as an error-level crash and printed nothing to the user.
-/** Stamp an existing Error with the boundary's caller-owned disposition. */
-export function markExpectedUserError(err) {
-    return Object.assign(err, { expected: true });
-}
 /**
  * True when `err` is an Error explicitly marked `expected === true`. A non-null
  * result means the top-level handler should print `err.message` and skip Sentry

package/dist/utils/feedback-diagnostics.d.ts

@@ -1,6 +1,6 @@
 import { type VersionInfo } from "./feedback-versions.js";
 import type { FeedbackLogsBlob } from "./feedback-logs.js";
-interface GitContext {
+export interface GitContext {
     branch: string | null;
     head: string | null;
     dirty: boolean;
@@ -37,5 +37,4 @@ export interface DiagnosticsBlob {
 }
 export declare function sanitizeArgv(argv: string[]): string[];
 export declare function collectDiagnostics(): DiagnosticsBlob;
-export {};
 //# sourceMappingURL=feedback-diagnostics.d.ts.map

package/dist/utils/feedback-log-bundle.d.ts

@@ -6,7 +6,7 @@
  * body above 64 KiB, and `diagnostics` is written into a DynamoDB item, which
  * caps at 400 KB. Neither can be tuned into carrying a real log history, so the
  * inline blob is deliberately a ~40 KiB summary of 16 KiB tails. This module
- * produces the other half: a zipped bundle uploaded direct to S3, carrying the
+ * produces the other half: a gzipped bundle uploaded direct to S3, carrying the
  * files whole rather than in tail-sized slivers.
  *
  * Three properties are load-bearing and none may be traded away:
@@ -25,33 +25,17 @@
  *   3. BOUNDED MEMORY. 50 MB compressed is roughly a gigabyte of raw log text
  *      at the ratio these files compress at. Nothing is ever fully materialised:
  *      files are read in slices, redacted a line at a time, and streamed into
- *      the deflate stream, with only the compressed output retained.
+ *      gzip, with only the compressed output retained.
  *
- * WHY ZIP AND NOT GZIP. This bundle is attached to a Slack thread by the
- * hq-pro feedback worker, and Slack's `files.completeUploadExternal` refuses a
- * gzip member from this app at ANY size — a 52-byte gzip was rejected with
- * `internal_error`, while the same bytes as zip were accepted. That was the
- * root cause of roughly 110 consecutive silent attachment failures. The worker
- * carries a gz-to-zip repack so older CLIs still get an attachable bundle;
- * emitting zip here means the common path never pays for that unpack, and the
- * archive is the format the destination actually accepts.
- *
- * A single deflate member wrapped in a ZIP32 container, one entry. The stream
- * is raw deflate so the container's own CRC and sizes are the only integrity
- * record; crc32 is folded in incrementally as lines are written, and the local
- * header, central directory, and EOCD are assembled once at finish. The size
- * budget is charged on the container, not the member, so the ~98 bytes of
- * framing can never be what pushes an upload past the server's ceiling.
- *
- * Output format inside the entry — NDJSON, one JSON record per line:
+ * Output format — gzipped NDJSON, one JSON record per line:
  *   {"kind":"manifest","version":1,...}                    exactly one, first
  *   {"kind":"file","name":"logs/hq-sync.log",...}          one per file
  *   {"kind":"chunk","name":"logs/hq-sync.log","seq":0,...} many per file
  *   {"kind":"summary","fileCount":12,...}                  exactly one, last
  *
- * NDJSON inside the entry rather than a tar of separate members, so a
- * truncated bundle is still parseable line-by-line up to the cut, and so the
- * records carry the same redaction metadata the inline blob already reports.
+ * NDJSON rather than tar so there is no archive dependency, so a truncated
+ * bundle is still parseable line-by-line up to the cut, and so the records
+ * carry the same redaction metadata the inline blob already reports.
  */
 import { type LogCandidate } from "./feedback-logs.js";
 import { vaultApiFetch } from "./vault-api.js";
@@ -61,10 +45,26 @@ import { vaultApiFetch } from "./vault-api.js";
  * stay in step or the CLI will build bundles the server will not accept.
  */
 export declare const LOG_BUNDLE_MAX_BYTES: number;
+/**
+ * Headroom between the size we stop feeding at and the hard cap.
+ *
+ * gzip reports compressed bytes only as its internal buffer flushes, so the
+ * running total lags the bytes actually consumed. The lag is bounded by that
+ * buffer (tens of KiB); a 1 MiB margin covers it with three orders of magnitude
+ * to spare, and the final size is asserted against the real cap regardless.
+ */
+export declare const LOG_BUNDLE_SAFETY_MARGIN_BYTES: number;
+/**
+ * Per-file raw ceiling. The desktop logger rotates at 32 MiB (hq-desktop-core
+ * `logfile.rs`), so this admits a full generation with headroom while stopping
+ * one pathological file from consuming the whole bundle. Files above it are
+ * read from the TAIL — the end of a log is what explains a failure.
+ */
+export declare const LOG_BUNDLE_MAX_FILE_RAW_BYTES: number;
 export interface LogBundleResult {
-    /** The zipped NDJSON bytes, ready to PUT. */
-    bytes: Buffer;
-    /** `bytes.byteLength` — what the presign request must declare. */
+    /** The gzipped NDJSON bytes, ready to PUT. */
+    gzip: Buffer;
+    /** `gzip.byteLength` — what the presign request must declare. */
     sizeBytes: number;
     /** How many files contributed at least one chunk. */
     fileCount: number;
@@ -95,12 +95,6 @@ export interface BuildLogBundleOptions {
     homeDir?: string;
     /** Override the per-file raw ceiling (tests). */
     maxFileRawBytes?: number;
-    /**
-     * Uncompressed ceiling for the zip entry. Clamped to what ZIP32 can describe,
-     * so a caller can lower this but never raise it past the format's limit.
-     * Exists so the ceiling is exercisable without a test that allocates 4 GiB.
-     */
-    maxEntryBytes?: number;
 }
 /**
  * Order candidates so that, when the cap truncates collection, what survives is
@@ -113,25 +107,6 @@ export interface BuildLogBundleOptions {
  * crowd out a stale claim in the inline collector.
  */
 export declare function orderBundleCandidates(hqDir: string): LogCandidate[];
-/**
- * Name of the single entry inside the zip. The `.ndjson` extension is what
- * tells a triager (and `jq`) what is inside once it is unzipped.
- */
-export declare const LOG_BUNDLE_ENTRY_NAME = "hq-logs.ndjson";
-/** The line collection actually stops at. Never above what ZIP32 can describe. */
-export declare const ZIP32_UNCOMPRESSED_STOP_BYTES: number;
-/**
- * Resolve the entry ceiling a caller asked for. A caller may lower it; nothing
- * may raise it past what the container can describe, because a ceiling above
- * the format's limit is not a ceiling at all.
- */
-export declare function entryCeiling(requested?: number): number;
-export declare function crc32Fallback(buf: Buffer, seed?: number): number;
-/**
- * Bytes of ZIP framing around one entry: local header, central directory
- * header, end-of-central-directory. The name is stored twice.
- */
-export declare function zipOverheadBytes(entryName: string): number;
 /**
  * Read `absPath` in slices, redacting whole lines, invoking `onChunk` with
  * roughly {@link CHUNK_TEXT_BYTES} of redacted text at a time.
@@ -145,7 +120,7 @@ export declare function streamRedactedFile(absPath: string, sizeBytes: number, m
     stopped: boolean;
 }>;
 /**
- * Build a zipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
+ * Build a gzipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
  *
  * Returns `undefined` when nothing eligible exists, so the caller can skip the
  * upload entirely. Never throws: a bug report must not fail over its own