@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/utils/feedback-log-bundle.js

@@ -6,7 +6,7 @@
  * body above 64 KiB, and `diagnostics` is written into a DynamoDB item, which
  * caps at 400 KB. Neither can be tuned into carrying a real log history, so the
  * inline blob is deliberately a ~40 KiB summary of 16 KiB tails. This module
- * produces the other half: a zipped bundle uploaded direct to S3, carrying the
+ * produces the other half: a gzipped bundle uploaded direct to S3, carrying the
  * files whole rather than in tail-sized slivers.
  *
  * Three properties are load-bearing and none may be traded away:
@@ -25,33 +25,17 @@
  *   3. BOUNDED MEMORY. 50 MB compressed is roughly a gigabyte of raw log text
  *      at the ratio these files compress at. Nothing is ever fully materialised:
  *      files are read in slices, redacted a line at a time, and streamed into
- *      the deflate stream, with only the compressed output retained.
+ *      gzip, with only the compressed output retained.
  *
- * WHY ZIP AND NOT GZIP. This bundle is attached to a Slack thread by the
- * hq-pro feedback worker, and Slack's `files.completeUploadExternal` refuses a
- * gzip member from this app at ANY size — a 52-byte gzip was rejected with
- * `internal_error`, while the same bytes as zip were accepted. That was the
- * root cause of roughly 110 consecutive silent attachment failures. The worker
- * carries a gz-to-zip repack so older CLIs still get an attachable bundle;
- * emitting zip here means the common path never pays for that unpack, and the
- * archive is the format the destination actually accepts.
- *
- * A single deflate member wrapped in a ZIP32 container, one entry. The stream
- * is raw deflate so the container's own CRC and sizes are the only integrity
- * record; crc32 is folded in incrementally as lines are written, and the local
- * header, central directory, and EOCD are assembled once at finish. The size
- * budget is charged on the container, not the member, so the ~98 bytes of
- * framing can never be what pushes an upload past the server's ceiling.
- *
- * Output format inside the entry — NDJSON, one JSON record per line:
+ * Output format — gzipped NDJSON, one JSON record per line:
  *   {"kind":"manifest","version":1,...}                    exactly one, first
  *   {"kind":"file","name":"logs/hq-sync.log",...}          one per file
  *   {"kind":"chunk","name":"logs/hq-sync.log","seq":0,...} many per file
  *   {"kind":"summary","fileCount":12,...}                  exactly one, last
  *
- * NDJSON inside the entry rather than a tar of separate members, so a
- * truncated bundle is still parseable line-by-line up to the cut, and so the
- * records carry the same redaction metadata the inline blob already reports.
+ * NDJSON rather than tar so there is no archive dependency, so a truncated
+ * bundle is still parseable line-by-line up to the cut, and so the records
+ * carry the same redaction metadata the inline blob already reports.
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -66,29 +50,22 @@ import { vaultApiFetch } from "./vault-api.js";
  * stay in step or the CLI will build bundles the server will not accept.
  */
 export const LOG_BUNDLE_MAX_BYTES = 50 * 1024 * 1024;
-/**
- * What the presign request declares, and what the server must answer with.
- * Mirrors `LOG_BUNDLE_FORMAT_ZIP` / `LOG_BUNDLE_ZIP_CONTENT_TYPE` in the hq-pro
- * handler `feedback-log-bundles.ts`.
- */
-const LOG_BUNDLE_FORMAT = "zip";
-const LOG_BUNDLE_CONTENT_TYPE = "application/zip";
 /**
  * Headroom between the size we stop feeding at and the hard cap.
  *
- * deflate reports compressed bytes only as its internal buffer flushes, so the
+ * gzip reports compressed bytes only as its internal buffer flushes, so the
  * running total lags the bytes actually consumed. The lag is bounded by that
  * buffer (tens of KiB); a 1 MiB margin covers it with three orders of magnitude
  * to spare, and the final size is asserted against the real cap regardless.
  */
-const LOG_BUNDLE_SAFETY_MARGIN_BYTES = 1024 * 1024;
+export const LOG_BUNDLE_SAFETY_MARGIN_BYTES = 1024 * 1024;
 /**
  * Per-file raw ceiling. The desktop logger rotates at 32 MiB (hq-desktop-core
  * `logfile.rs`), so this admits a full generation with headroom while stopping
  * one pathological file from consuming the whole bundle. Files above it are
  * read from the TAIL — the end of a log is what explains a failure.
  */
-const LOG_BUNDLE_MAX_FILE_RAW_BYTES = 64 * 1024 * 1024;
+export const LOG_BUNDLE_MAX_FILE_RAW_BYTES = 64 * 1024 * 1024;
 /** Read slice size. Bounds peak memory; unrelated to the output chunking. */
 const READ_SLICE_BYTES = 4 * 1024 * 1024;
 /** Target raw text per emitted chunk record. Keeps NDJSON lines manageable. */
@@ -155,171 +132,24 @@ export function orderBundleCandidates(hqDir) {
     const logs = discoverLogFiles(hqDir).sort((a, b) => b.modifiedMs - a.modifiedMs || a.name.localeCompare(b.name));
     return [...state, ...logs];
 }
-/**
- * Name of the single entry inside the zip. The `.ndjson` extension is what
- * tells a triager (and `jq`) what is inside once it is unzipped.
- */
-export const LOG_BUNDLE_ENTRY_NAME = "hq-logs.ndjson";
-/**
- * ZIP32 stores the uncompressed size in 32 bits, so a bundle whose contents
- * exceed 4 GiB cannot be described by the container at all.
- *
- * The compressed cap does not prevent this. Log text compresses at roughly 24x
- * in practice but there is no upper bound on the ratio — repetitive logs go
- * far higher — and discovery admits an unbounded number of files at up to
- * {@link LOG_BUNDLE_MAX_FILE_RAW_BYTES} each. Collection stops at the line
- * below and reports `truncated`, which is what the caller already handles;
- * without it `writeUInt32LE` throws at finish and the outer catch discards the
- * whole bundle, so the installation with the most logs would send none.
- */
-const ZIP32_MAX_UNCOMPRESSED_BYTES = 0xffffffff;
-/**
- * Room left below the ZIP32 ceiling for the chunk in flight plus the closing
- * summary record. A chunk is written whole before the budget is re-checked.
- */
-const ZIP32_UNCOMPRESSED_MARGIN_BYTES = 1024 * 1024;
-/** The line collection actually stops at. Never above what ZIP32 can describe. */
-export const ZIP32_UNCOMPRESSED_STOP_BYTES = ZIP32_MAX_UNCOMPRESSED_BYTES - ZIP32_UNCOMPRESSED_MARGIN_BYTES;
-/**
- * Resolve the entry ceiling a caller asked for. A caller may lower it; nothing
- * may raise it past what the container can describe, because a ceiling above
- * the format's limit is not a ceiling at all.
- */
-export function entryCeiling(requested) {
-    if (requested === undefined || !Number.isFinite(requested)) {
-        return ZIP32_UNCOMPRESSED_STOP_BYTES;
-    }
-    return Math.max(0, Math.min(requested, ZIP32_UNCOMPRESSED_STOP_BYTES));
-}
-/**
- * crc32 with a fallback, because `zlib.crc32` is newer than this package's
- * floor: it landed in Node 22.2.0 and was backported only to 20.15.0, while
- * `engines.node` is `>=20.0.0`. On Node 20.0-20.14 and 21.x the native call is
- * undefined, the first sink write throws, and `buildLogBundle` catches it and
- * returns undefined — every report on those runtimes silently loses its log
- * bundle. The table is built once, on first use, and only when needed.
- */
-let crcTable = null;
-export function crc32Fallback(buf, seed = 0) {
-    if (!crcTable) {
-        crcTable = new Uint32Array(256);
-        for (let i = 0; i < 256; i++) {
-            let c = i;
-            for (let k = 0; k < 8; k++)
-                c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-            crcTable[i] = c >>> 0;
-        }
-    }
-    let crc = ~seed >>> 0;
-    for (let i = 0; i < buf.length; i++) {
-        crc = (crcTable[(crc ^ buf[i]) & 0xff] ^ (crc >>> 8)) >>> 0;
-    }
-    return (~crc >>> 0) >>> 0;
-}
-/** Exported for the test that proves the fallback agrees with the native one. */
-function crc32(buf, seed = 0) {
-    const native = zlib.crc32;
-    return typeof native === "function" ? native(buf, seed) : crc32Fallback(buf, seed);
-}
-/** Local file header, central directory header, and EOCD signatures. */
-const ZIP_LOCAL_SIG = 0x04034b50;
-const ZIP_CENTRAL_SIG = 0x02014b50;
-const ZIP_EOCD_SIG = 0x06054b50;
-/** Deflate, no data descriptor: sizes and CRC are known before a header is written. */
-const ZIP_METHOD_DEFLATE = 8;
-const ZIP_VERSION = 20;
-/**
- * A fixed MS-DOS timestamp, so the same logs produce the same bytes.
- *
- * Deliberately not the wall clock: a bundle's timing lives in the manifest
- * record, which is redacted content the recipient can read, rather than in
- * archive metadata that no tool here surfaces. 0x0021 is 1980-01-01, the
- * earliest the format can represent.
- */
-const ZIP_DOS_TIME = 0;
-const ZIP_DOS_DATE = 0x0021;
-/**
- * Bytes of ZIP framing around one entry: local header, central directory
- * header, end-of-central-directory. The name is stored twice.
- */
-export function zipOverheadBytes(entryName) {
-    return 30 + 46 + 22 + Buffer.byteLength(entryName, "utf8") * 2;
-}
-function createZipSink(entryName = LOG_BUNDLE_ENTRY_NAME, maxUncompressed = ZIP32_UNCOMPRESSED_STOP_BYTES) {
-    const name = Buffer.from(entryName, "utf8");
-    const deflate = zlib.createDeflateRaw({ level: 9 });
+function createGzipSink() {
+    const gzip = zlib.createGzip({ level: 9 });
     const parts = [];
-    const overhead = zipOverheadBytes(entryName);
     let compressed = 0;
-    let uncompressed = 0;
-    let crc = 0;
     let failure = null;
-    deflate.on("data", (chunk) => {
+    gzip.on("data", (chunk) => {
         parts.push(chunk);
         compressed += chunk.byteLength;
     });
-    deflate.on("error", (err) => {
+    gzip.on("error", (err) => {
         failure = err;
     });
-    function container(body) {
-        const local = Buffer.alloc(30);
-        local.writeUInt32LE(ZIP_LOCAL_SIG, 0);
-        local.writeUInt16LE(ZIP_VERSION, 4);
-        local.writeUInt16LE(0, 6); // flags
-        local.writeUInt16LE(ZIP_METHOD_DEFLATE, 8);
-        local.writeUInt16LE(ZIP_DOS_TIME, 10);
-        local.writeUInt16LE(ZIP_DOS_DATE, 12);
-        local.writeUInt32LE(crc >>> 0, 14);
-        local.writeUInt32LE(body.byteLength, 18);
-        local.writeUInt32LE(uncompressed, 22);
-        local.writeUInt16LE(name.byteLength, 26);
-        local.writeUInt16LE(0, 28); // extra length
-        const central = Buffer.alloc(46);
-        central.writeUInt32LE(ZIP_CENTRAL_SIG, 0);
-        central.writeUInt16LE(ZIP_VERSION, 4); // version made by
-        central.writeUInt16LE(ZIP_VERSION, 6); // version needed
-        central.writeUInt16LE(0, 8); // flags
-        central.writeUInt16LE(ZIP_METHOD_DEFLATE, 10);
-        central.writeUInt16LE(ZIP_DOS_TIME, 12);
-        central.writeUInt16LE(ZIP_DOS_DATE, 14);
-        central.writeUInt32LE(crc >>> 0, 16);
-        central.writeUInt32LE(body.byteLength, 20);
-        central.writeUInt32LE(uncompressed, 24);
-        central.writeUInt16LE(name.byteLength, 28);
-        central.writeUInt16LE(0, 30); // extra
-        central.writeUInt16LE(0, 32); // comment
-        central.writeUInt16LE(0, 34); // disk number start
-        central.writeUInt16LE(0, 36); // internal attrs
-        central.writeUInt32LE(0, 38); // external attrs
-        central.writeUInt32LE(0, 42); // local header offset
-        const centralSize = central.byteLength + name.byteLength;
-        const centralOffset = local.byteLength + name.byteLength + body.byteLength;
-        const eocd = Buffer.alloc(22);
-        eocd.writeUInt32LE(ZIP_EOCD_SIG, 0);
-        eocd.writeUInt16LE(0, 4); // this disk
-        eocd.writeUInt16LE(0, 6); // disk with central dir
-        eocd.writeUInt16LE(1, 8); // entries on this disk
-        eocd.writeUInt16LE(1, 10); // entries total
-        eocd.writeUInt32LE(centralSize, 12);
-        eocd.writeUInt32LE(centralOffset, 16);
-        eocd.writeUInt16LE(0, 20); // comment length
-        return Buffer.concat([local, name, body, central, name, eocd]);
-    }
     return {
-        // The budget is charged on what will be PUT, framing included, so the
-        // container can never be what carries the upload over the server's cap.
-        compressedBytes: () => overhead + compressed,
-        atUncompressedLimit: () => uncompressed > maxUncompressed,
+        compressedBytes: () => compressed,
         write: (line) => new Promise((resolve, reject) => {
             if (failure)
                 return reject(failure);
-            const buf = Buffer.from(line, "utf8");
-            // Folded in as we go: the whole point of this module is that the
-            // uncompressed text is never materialised, so there is nothing to
-            // checksum at the end.
-            crc = crc32(buf, crc);
-            uncompressed += buf.byteLength;
-            deflate.write(buf, (err) => (err ? reject(err) : resolve()));
+            gzip.write(line, "utf8", (err) => (err ? reject(err) : resolve()));
         }),
         // Z_SYNC_FLUSH costs a handful of bytes per boundary and a little ratio.
         // That is the price of a budget that is enforced rather than estimated:
@@ -329,13 +159,13 @@ function createZipSink(entryName = LOG_BUNDLE_ENTRY_NAME, maxUncompressed = ZIP3
         sync: () => new Promise((resolve, reject) => {
             if (failure)
                 return reject(failure);
-            deflate.flush(zlib.constants.Z_SYNC_FLUSH, () => resolve());
+            gzip.flush(zlib.constants.Z_SYNC_FLUSH, () => resolve());
         }),
         finish: () => new Promise((resolve, reject) => {
-            deflate.on("end", () => failure ? reject(failure) : resolve(container(Buffer.concat(parts))));
-            deflate.on("error", reject);
-            deflate.end();
-            deflate.resume();
+            gzip.on("end", () => (failure ? reject(failure) : resolve(Buffer.concat(parts))));
+            gzip.on("error", reject);
+            gzip.end();
+            gzip.resume();
         }),
     };
 }
@@ -438,7 +268,7 @@ export async function streamRedactedFile(absPath, sizeBytes, maxRawBytes, chunkB
     }
 }
 /**
- * Build a zipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
+ * Build a gzipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
  *
  * Returns `undefined` when nothing eligible exists, so the caller can skip the
  * upload entirely. Never throws: a bug report must not fail over its own
@@ -464,7 +294,7 @@ export async function buildLogBundle(opts = {}) {
     if (candidates.length === 0)
         return undefined;
     try {
-        const sink = createZipSink(LOG_BUNDLE_ENTRY_NAME, entryCeiling(opts.maxEntryBytes));
+        const sink = createGzipSink();
         let fileCount = 0;
         let rawBytes = 0;
         let redactions = 0;
@@ -479,7 +309,7 @@ export async function buildLogBundle(opts = {}) {
         }));
         for (const candidate of candidates) {
             await sink.sync();
-            if (sink.compressedBytes() > stopAt || sink.atUncompressedLimit()) {
+            if (sink.compressedBytes() > stopAt) {
                 truncated = true;
                 break;
             }
@@ -504,7 +334,7 @@ export async function buildLogBundle(opts = {}) {
                     // Stop feeding once the compressed total reaches the stop line.
                     // The sync is what makes that total trustworthy.
                     await sink.sync();
-                    return sink.compressedBytes() <= stopAt && !sink.atUncompressedLimit();
+                    return sink.compressedBytes() <= stopAt;
                 });
                 stopped = result.stopped;
             }
@@ -519,18 +349,18 @@ export async function buildLogBundle(opts = {}) {
             }
         }
         await sink.write(record({ kind: "summary", fileCount, rawBytes, redactions, truncated }));
-        const bytes = await sink.finish();
+        const gzip = await sink.finish();
         // Nothing but a manifest and a summary is not worth uploading.
         if (fileCount === 0)
             return undefined;
         // Final authority. The stop line plus margin should make this unreachable,
         // but the server refuses to presign above the cap, so a bundle that
         // overshot is useless and must not be offered.
-        if (bytes.byteLength > maxBytes)
+        if (gzip.byteLength > maxBytes)
             return undefined;
         return {
-            bytes,
-            sizeBytes: bytes.byteLength,
+            gzip,
+            sizeBytes: gzip.byteLength,
             fileCount,
             truncated,
             rawBytes,
@@ -565,10 +395,7 @@ export async function uploadLogBundle(opts) {
             token: opts.token,
             path: "/v1/feedback/logs/presign",
             method: "POST",
-            // The server owns the key and the signed content type, so it has to be
-            // told which format is coming; without this it mints a `.ndjson.gz` slot
-            // signed `application/gzip` and the PUT would be a lie on both counts.
-            body: { sizeBytes: bundle.sizeBytes, format: LOG_BUNDLE_FORMAT },
+            body: { sizeBytes: bundle.sizeBytes },
         });
         if (!res.ok)
             return undefined;
@@ -577,22 +404,15 @@ export async function uploadLogBundle(opts) {
         if (!slot || typeof slot.key !== "string" || typeof slot.url !== "string") {
             return undefined;
         }
-        // A server too old to know about `format` answers with a gzip slot. Its
-        // signature binds `application/gzip` and its key claims `.gz`, and these
-        // bytes are neither. Skipping is the honest outcome and costs only the
-        // bundle — the submission still carries the inline logs, which is exactly
-        // what happens when bundles are disabled entirely.
-        if (slot.contentType !== LOG_BUNDLE_CONTENT_TYPE)
-            return undefined;
         const doFetch = opts.fetchImpl ?? fetch;
         const put = await doFetch(slot.url, {
             method: "PUT",
             headers: {
-                "Content-Type": slot.contentType,
+                "Content-Type": typeof slot.contentType === "string" ? slot.contentType : "application/gzip",
                 // Must match the length bound into the signature, or S3 rejects it.
                 "Content-Length": String(bundle.sizeBytes),
             },
-            body: new Uint8Array(bundle.bytes),
+            body: new Uint8Array(bundle.gzip),
         });
         if (!put.ok)
             return undefined;

package/dist/utils/feedback-logs.d.ts

@@ -13,9 +13,8 @@
  *     (`hq-sync.log.1`, `.2`, `.3`) are eligible too — just after a rotation
  *     the active file is nearly empty and the history lives in `.1`.
  *     `logs/mcp-registry.log` is the CLI's own append-only MCP audit trail.
- *     The daemon runner's `daemon/logs/sync.log` and its three rotations are
- *     eligible too. When both sync families exist, only the newer family is
- *     attached.
+ *     Any future `*.log`/`*.jsonl` dropped into `~/.hq/logs/` is picked up
+ *     automatically.
  *
  *   - STATE SNAPSHOTS (`state`) — small JSON files that describe where sync
  *     and client health currently stand: the in-flight sync phase and conflict
@@ -37,9 +36,8 @@
  *
  *   1. ALLOWLIST, NOT A SCAN. `~/.hq` also holds `cognito-tokens.json`,
  *      `deploy-passwords.json`, and `secrets-cache/`. Only `*.log` files
- *      directly inside `~/.hq/logs/`, the exact daemon sync-log generations
- *      under the configured daemon root, and the two known root-level boot
- *      logs are eligible. A recursive walk over `~/.hq` is a credential leak
+ *      directly inside `~/.hq/logs/` plus the two known root-level boot logs
+ *      are ever eligible. A recursive walk over `~/.hq` is a credential leak
  *      and must never be introduced here.
  *
  *   2. NO SYMLINKS. Eligibility is decided with `lstat`, and a candidate must
@@ -84,6 +82,13 @@ export declare const FEEDBACK_LOGS_MIN_USEFUL_BYTES = 1024;
  * evidence. The overflow count preserves the signal without the bytes.
  */
 export declare const FEEDBACK_MAX_SKIPPED_ENTRIES = 25;
+/** Subdirectory of `~/.hq` whose log files are eligible. Not recursive. */
+export declare const FEEDBACK_LOGS_DIRNAME = "logs";
+/**
+ * Eligible extensions inside `~/.hq/logs/`. `.jsonl` is included because the
+ * CLI's MCP registry audit trail is JSON-lines, not plain text.
+ */
+export declare const FEEDBACK_LOG_EXTENSIONS: readonly string[];
 /**
  * True for a log filename, including a ROTATED generation.
  *
@@ -96,6 +101,26 @@ export declare const FEEDBACK_MAX_SKIPPED_ENTRIES = 25;
 export declare function isEligibleLogName(name: string): boolean;
 /** Per-state-file ceiling. These are status documents, not streams. */
 export declare const FEEDBACK_STATE_MAX_FILE_BYTES: number;
+/**
+ * Ceiling on all state snapshots combined. Deliberately a small slice of the
+ * overall budget: state is dense but finite, and the rest belongs to logs.
+ */
+export declare const FEEDBACK_STATE_MAX_TOTAL_BYTES: number;
+/**
+ * State files at the `~/.hq` ROOT that are eligible, by EXACT name.
+ *
+ * The root is where `cognito-tokens.json`, `deploy-passwords.json`, and
+ * `secrets-cache/` live, so it is never globbed. Adding a name here is a
+ * deliberate act: confirm the file carries no credential before listing it.
+ */
+export declare const FEEDBACK_STATE_FILENAMES: readonly string[];
+/**
+ * Per-company sync journal LOCATORS (`sync-journal.<slug>.json`) are also
+ * eligible. Matched by an exact prefix AND a `.json` suffix, which is what
+ * excludes the multi-hundred-megabyte `…json.last-good` snapshots sitting
+ * beside them. No credential file at the root carries this prefix.
+ */
+export declare const FEEDBACK_STATE_JOURNAL_PREFIX = "sync-journal.";
 /**
  * `~/.hq/locks/` — held operation locks and background-work claims.
  *
@@ -114,6 +139,8 @@ export declare const FEEDBACK_LOCKS_DIRNAME = "locks";
  * bounds that walk carries.
  */
 export declare const FEEDBACK_JOBS_DIRNAME = "jobs";
+/** Per-entry ceiling for a lock file. Their value is the name plus a little context. */
+export declare const FEEDBACK_LOCK_MAX_FILE_BYTES = 512;
 /**
  * Bounds on the `jobs/` walk. Depth 3 reaches
  * `jobs/probes/<job>/last-attempt.json`; the file cap stops a pathological
@@ -123,9 +150,15 @@ export declare const FEEDBACK_JOBS_MAX_DEPTH = 3;
 export declare const FEEDBACK_JOBS_MAX_FILES = 20;
 /** Ceiling on how many lock entries are collected. */
 export declare const FEEDBACK_LOCKS_MAX_FILES = 20;
+/**
+ * Log files that live at the root of `~/.hq` rather than under `logs/`.
+ * Listed explicitly — the root directory holds credentials and must never be
+ * enumerated by pattern.
+ */
+export declare const FEEDBACK_ROOT_LOG_FILENAMES: readonly string[];
 /** Why a discovered log file contributed nothing to the submission. */
-type SkipReason = "budget" | "empty" | "unreadable";
-interface LogTail {
+export type SkipReason = "budget" | "empty" | "unreadable";
+export interface LogTail {
     /** Path relative to `~/.hq`, e.g. `logs/hq-sync.log`. Never absolute. */
     name: string;
     /** Full on-disk size, even when only a tail was included. */
@@ -142,7 +175,7 @@ interface LogTail {
     tail: string;
 }
 /** A small JSON status document included whole (or head-truncated). */
-interface StateSnapshot {
+export interface StateSnapshot {
     /** Path relative to `~/.hq`, e.g. `sync-progress.json`. Never absolute. */
     name: string;
     sizeBytes: number;
@@ -202,13 +235,12 @@ export declare function feedbackLogsEnabled(env?: NodeJS.ProcessEnv): boolean;
  * Enumerate eligible log files under `hqDir`.
  *
  * Eligibility is the allowlist described in the module header: `*.log` files
- * directly inside `hqDir/logs/`, the exact daemon sync-log generations, plus
- * {@link FEEDBACK_ROOT_LOG_FILENAMES} at the root. Every candidate must be a
- * REGULAR file by `lstat` — directories and, critically, symlinks are rejected.
- * Returned newest-modified first so the most relevant log is offered budget
- * before older ones.
+ * directly inside `hqDir/logs/`, plus {@link FEEDBACK_ROOT_LOG_FILENAMES} at
+ * the root. Every candidate must be a REGULAR file by `lstat` — directories
+ * and, critically, symlinks are rejected. Returned newest-modified first so
+ * the most relevant log is offered the budget before older ones.
  */
-export declare function discoverLogFiles(hqDir: string, env?: NodeJS.ProcessEnv): LogCandidate[];
+export declare function discoverLogFiles(hqDir: string): LogCandidate[];
 /**
  * Read the last `maxBytes` of a file.
  *
@@ -282,8 +314,6 @@ export interface CollectFeedbackLogsOptions {
     hqDir?: string;
     /** Override the home directory used to derive `~/.hq` (tests). */
     homeDir?: string;
-    /** Override process environment for configured log paths (tests). */
-    env?: NodeJS.ProcessEnv;
 }
 /**
  * Collect redacted `~/.hq` evidence within `budgetBytes`.
@@ -296,5 +326,4 @@ export interface CollectFeedbackLogsOptions {
  * omit the field entirely rather than attach an empty object. Never throws.
  */
 export declare function collectFeedbackLogs(opts?: CollectFeedbackLogsOptions): FeedbackLogsBlob | undefined;
-export {};
 //# sourceMappingURL=feedback-logs.d.ts.map

package/dist/utils/feedback-logs.js

@@ -13,9 +13,8 @@
  *     (`hq-sync.log.1`, `.2`, `.3`) are eligible too — just after a rotation
  *     the active file is nearly empty and the history lives in `.1`.
  *     `logs/mcp-registry.log` is the CLI's own append-only MCP audit trail.
- *     The daemon runner's `daemon/logs/sync.log` and its three rotations are
- *     eligible too. When both sync families exist, only the newer family is
- *     attached.
+ *     Any future `*.log`/`*.jsonl` dropped into `~/.hq/logs/` is picked up
+ *     automatically.
  *
  *   - STATE SNAPSHOTS (`state`) — small JSON files that describe where sync
  *     and client health currently stand: the in-flight sync phase and conflict
@@ -37,9 +36,8 @@
  *
  *   1. ALLOWLIST, NOT A SCAN. `~/.hq` also holds `cognito-tokens.json`,
  *      `deploy-passwords.json`, and `secrets-cache/`. Only `*.log` files
- *      directly inside `~/.hq/logs/`, the exact daemon sync-log generations
- *      under the configured daemon root, and the two known root-level boot
- *      logs are eligible. A recursive walk over `~/.hq` is a credential leak
+ *      directly inside `~/.hq/logs/` plus the two known root-level boot logs
+ *      are ever eligible. A recursive walk over `~/.hq` is a credential leak
  *      and must never be introduced here.
  *
  *   2. NO SYMLINKS. Eligibility is decided with `lstat`, and a candidate must
@@ -60,7 +58,6 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { currentSyncLogFamily, SYNC_LOG_RELATIVE_PATHS, SYNC_LOG_GENERATIONS, syncLogBasePaths, syncLogFamilyForRelativePath, syncLogGenerationPath, } from "./sync-log-sources.js";
 /**
  * Ceiling on the total redacted log text attached to one submission.
  *
@@ -89,12 +86,12 @@ export const FEEDBACK_LOGS_MIN_USEFUL_BYTES = 1024;
  */
 export const FEEDBACK_MAX_SKIPPED_ENTRIES = 25;
 /** Subdirectory of `~/.hq` whose log files are eligible. Not recursive. */
-const FEEDBACK_LOGS_DIRNAME = "logs";
+export const FEEDBACK_LOGS_DIRNAME = "logs";
 /**
  * Eligible extensions inside `~/.hq/logs/`. `.jsonl` is included because the
  * CLI's MCP registry audit trail is JSON-lines, not plain text.
  */
-const FEEDBACK_LOG_EXTENSIONS = [".log", ".jsonl"];
+export const FEEDBACK_LOG_EXTENSIONS = [".log", ".jsonl"];
 /**
  * True for a log filename, including a ROTATED generation.
  *
@@ -120,7 +117,7 @@ export const FEEDBACK_STATE_MAX_FILE_BYTES = 4 * 1024;
  * Ceiling on all state snapshots combined. Deliberately a small slice of the
  * overall budget: state is dense but finite, and the rest belongs to logs.
  */
-const FEEDBACK_STATE_MAX_TOTAL_BYTES = 12 * 1024;
+export const FEEDBACK_STATE_MAX_TOTAL_BYTES = 12 * 1024;
 /**
  * State files at the `~/.hq` ROOT that are eligible, by EXACT name.
  *
@@ -128,7 +125,7 @@ const FEEDBACK_STATE_MAX_TOTAL_BYTES = 12 * 1024;
  * `secrets-cache/` live, so it is never globbed. Adding a name here is a
  * deliberate act: confirm the file carries no credential before listing it.
  */
-const FEEDBACK_STATE_FILENAMES = [
+export const FEEDBACK_STATE_FILENAMES = [
     // In-flight sync: phase, file counts, conflict count, current file.
     "sync-progress.json",
     // Sync contract version the installation last wrote.
@@ -150,7 +147,7 @@ const FEEDBACK_STATE_FILENAMES = [
  * excludes the multi-hundred-megabyte `…json.last-good` snapshots sitting
  * beside them. No credential file at the root carries this prefix.
  */
-const FEEDBACK_STATE_JOURNAL_PREFIX = "sync-journal.";
+export const FEEDBACK_STATE_JOURNAL_PREFIX = "sync-journal.";
 /**
  * `~/.hq/locks/` — held operation locks and background-work claims.
  *
@@ -170,7 +167,7 @@ export const FEEDBACK_LOCKS_DIRNAME = "locks";
  */
 export const FEEDBACK_JOBS_DIRNAME = "jobs";
 /** Per-entry ceiling for a lock file. Their value is the name plus a little context. */
-const FEEDBACK_LOCK_MAX_FILE_BYTES = 512;
+export const FEEDBACK_LOCK_MAX_FILE_BYTES = 512;
 /**
  * Bounds on the `jobs/` walk. Depth 3 reaches
  * `jobs/probes/<job>/last-attempt.json`; the file cap stops a pathological
@@ -185,7 +182,7 @@ export const FEEDBACK_LOCKS_MAX_FILES = 20;
  * Listed explicitly — the root directory holds credentials and must never be
  * enumerated by pattern.
  */
-const FEEDBACK_ROOT_LOG_FILENAMES = [
+export const FEEDBACK_ROOT_LOG_FILENAMES = [
     "boot-sync.log",
     "boot-capture.log",
 ];
@@ -282,15 +279,15 @@ function lstatOrNull(absPath) {
  * Enumerate eligible log files under `hqDir`.
  *
  * Eligibility is the allowlist described in the module header: `*.log` files
- * directly inside `hqDir/logs/`, the exact daemon sync-log generations, plus
- * {@link FEEDBACK_ROOT_LOG_FILENAMES} at the root. Every candidate must be a
- * REGULAR file by `lstat` — directories and, critically, symlinks are rejected.
- * Returned newest-modified first so the most relevant log is offered budget
- * before older ones.
+ * directly inside `hqDir/logs/`, plus {@link FEEDBACK_ROOT_LOG_FILENAMES} at
+ * the root. Every candidate must be a REGULAR file by `lstat` — directories
+ * and, critically, symlinks are rejected. Returned newest-modified first so
+ * the most relevant log is offered the budget before older ones.
  */
-export function discoverLogFiles(hqDir, env = process.env) {
+export function discoverLogFiles(hqDir) {
     const candidates = [];
-    const consider = (relName, absPath = path.join(hqDir, relName)) => {
+    const consider = (relName) => {
+        const absPath = path.join(hqDir, relName);
         const st = lstatOrNull(absPath);
         // isFile() is false for both directories and symlinks under lstat. A
         // symlink here would be the credential-exfiltration path (see header).
@@ -316,37 +313,11 @@ export function discoverLogFiles(hqDir, env = process.env) {
             continue;
         consider(`${FEEDBACK_LOGS_DIRNAME}/${entry}`);
     }
-    const daemonLogPath = syncLogBasePaths(hqDir, env).daemon;
-    for (let generation = 0; generation < SYNC_LOG_GENERATIONS; generation += 1) {
-        const relName = syncLogGenerationPath(SYNC_LOG_RELATIVE_PATHS.daemon, generation);
-        const absPath = syncLogGenerationPath(daemonLogPath, generation);
-        consider(relName, absPath);
-    }
     for (const filename of FEEDBACK_ROOT_LOG_FILENAMES) {
         consider(filename);
     }
-    let desktopModifiedMs = null;
-    let daemonModifiedMs = null;
-    for (const candidate of candidates) {
-        const family = syncLogFamilyForRelativePath(candidate.name);
-        if (family === "desktop") {
-            desktopModifiedMs = desktopModifiedMs === null
-                ? candidate.modifiedMs
-                : Math.max(desktopModifiedMs, candidate.modifiedMs);
-        }
-        else if (family === "daemon") {
-            daemonModifiedMs = daemonModifiedMs === null
-                ? candidate.modifiedMs
-                : Math.max(daemonModifiedMs, candidate.modifiedMs);
-        }
-    }
-    const selectedFamily = currentSyncLogFamily(desktopModifiedMs, daemonModifiedMs);
-    const selected = candidates.filter((candidate) => {
-        const family = syncLogFamilyForRelativePath(candidate.name);
-        return family === null || family === selectedFamily;
-    });
-    selected.sort((a, b) => b.modifiedMs - a.modifiedMs);
-    return selected;
+    candidates.sort((a, b) => b.modifiedMs - a.modifiedMs);
+    return candidates;
 }
 /**
  * Read the last `maxBytes` of a file.
@@ -575,7 +546,7 @@ export function collectFeedbackLogs(opts = {}) {
     let logCandidates;
     let stateCandidates;
     try {
-        logCandidates = discoverLogFiles(hqDir, opts.env);
+        logCandidates = discoverLogFiles(hqDir);
         // Order matters: root status documents first, then the lock/claim files
         // (highest signal for a hang), then scheduled-job status. Under a tight
         // budget the earlier ones win, and that is the intended priority.