@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/utils/feedback-log-bundle.d.ts

@@ -6,7 +6,7 @@
  * body above 64 KiB, and `diagnostics` is written into a DynamoDB item, which
  * caps at 400 KB. Neither can be tuned into carrying a real log history, so the
  * inline blob is deliberately a ~40 KiB summary of 16 KiB tails. This module
- * produces the other half: a gzipped bundle uploaded direct to S3, carrying the
+ * produces the other half: a zipped bundle uploaded direct to S3, carrying the
  * files whole rather than in tail-sized slivers.
  *
  * Three properties are load-bearing and none may be traded away:
@@ -25,17 +25,33 @@
  *   3. BOUNDED MEMORY. 50 MB compressed is roughly a gigabyte of raw log text
  *      at the ratio these files compress at. Nothing is ever fully materialised:
  *      files are read in slices, redacted a line at a time, and streamed into
- *      gzip, with only the compressed output retained.
+ *      the deflate stream, with only the compressed output retained.
  *
- * Output format — gzipped NDJSON, one JSON record per line:
+ * WHY ZIP AND NOT GZIP. This bundle is attached to a Slack thread by the
+ * hq-pro feedback worker, and Slack's `files.completeUploadExternal` refuses a
+ * gzip member from this app at ANY size — a 52-byte gzip was rejected with
+ * `internal_error`, while the same bytes as zip were accepted. That was the
+ * root cause of roughly 110 consecutive silent attachment failures. The worker
+ * carries a gz-to-zip repack so older CLIs still get an attachable bundle;
+ * emitting zip here means the common path never pays for that unpack, and the
+ * archive is the format the destination actually accepts.
+ *
+ * A single deflate member wrapped in a ZIP32 container, one entry. The stream
+ * is raw deflate so the container's own CRC and sizes are the only integrity
+ * record; crc32 is folded in incrementally as lines are written, and the local
+ * header, central directory, and EOCD are assembled once at finish. The size
+ * budget is charged on the container, not the member, so the ~98 bytes of
+ * framing can never be what pushes an upload past the server's ceiling.
+ *
+ * Output format inside the entry — NDJSON, one JSON record per line:
  *   {"kind":"manifest","version":1,...}                    exactly one, first
  *   {"kind":"file","name":"logs/hq-sync.log",...}          one per file
  *   {"kind":"chunk","name":"logs/hq-sync.log","seq":0,...} many per file
  *   {"kind":"summary","fileCount":12,...}                  exactly one, last
  *
- * NDJSON rather than tar so there is no archive dependency, so a truncated
- * bundle is still parseable line-by-line up to the cut, and so the records
- * carry the same redaction metadata the inline blob already reports.
+ * NDJSON inside the entry rather than a tar of separate members, so a
+ * truncated bundle is still parseable line-by-line up to the cut, and so the
+ * records carry the same redaction metadata the inline blob already reports.
  */
 import { type LogCandidate } from "./feedback-logs.js";
 import { vaultApiFetch } from "./vault-api.js";
@@ -45,26 +61,10 @@ import { vaultApiFetch } from "./vault-api.js";
  * stay in step or the CLI will build bundles the server will not accept.
  */
 export declare const LOG_BUNDLE_MAX_BYTES: number;
-/**
- * Headroom between the size we stop feeding at and the hard cap.
- *
- * gzip reports compressed bytes only as its internal buffer flushes, so the
- * running total lags the bytes actually consumed. The lag is bounded by that
- * buffer (tens of KiB); a 1 MiB margin covers it with three orders of magnitude
- * to spare, and the final size is asserted against the real cap regardless.
- */
-export declare const LOG_BUNDLE_SAFETY_MARGIN_BYTES: number;
-/**
- * Per-file raw ceiling. The desktop logger rotates at 32 MiB (hq-desktop-core
- * `logfile.rs`), so this admits a full generation with headroom while stopping
- * one pathological file from consuming the whole bundle. Files above it are
- * read from the TAIL — the end of a log is what explains a failure.
- */
-export declare const LOG_BUNDLE_MAX_FILE_RAW_BYTES: number;
 export interface LogBundleResult {
-    /** The gzipped NDJSON bytes, ready to PUT. */
-    gzip: Buffer;
-    /** `gzip.byteLength` — what the presign request must declare. */
+    /** The zipped NDJSON bytes, ready to PUT. */
+    bytes: Buffer;
+    /** `bytes.byteLength` — what the presign request must declare. */
     sizeBytes: number;
     /** How many files contributed at least one chunk. */
     fileCount: number;
@@ -95,6 +95,12 @@ export interface BuildLogBundleOptions {
     homeDir?: string;
     /** Override the per-file raw ceiling (tests). */
     maxFileRawBytes?: number;
+    /**
+     * Uncompressed ceiling for the zip entry. Clamped to what ZIP32 can describe,
+     * so a caller can lower this but never raise it past the format's limit.
+     * Exists so the ceiling is exercisable without a test that allocates 4 GiB.
+     */
+    maxEntryBytes?: number;
 }
 /**
  * Order candidates so that, when the cap truncates collection, what survives is
@@ -107,6 +113,25 @@ export interface BuildLogBundleOptions {
  * crowd out a stale claim in the inline collector.
  */
 export declare function orderBundleCandidates(hqDir: string): LogCandidate[];
+/**
+ * Name of the single entry inside the zip. The `.ndjson` extension is what
+ * tells a triager (and `jq`) what is inside once it is unzipped.
+ */
+export declare const LOG_BUNDLE_ENTRY_NAME = "hq-logs.ndjson";
+/** The line collection actually stops at. Never above what ZIP32 can describe. */
+export declare const ZIP32_UNCOMPRESSED_STOP_BYTES: number;
+/**
+ * Resolve the entry ceiling a caller asked for. A caller may lower it; nothing
+ * may raise it past what the container can describe, because a ceiling above
+ * the format's limit is not a ceiling at all.
+ */
+export declare function entryCeiling(requested?: number): number;
+export declare function crc32Fallback(buf: Buffer, seed?: number): number;
+/**
+ * Bytes of ZIP framing around one entry: local header, central directory
+ * header, end-of-central-directory. The name is stored twice.
+ */
+export declare function zipOverheadBytes(entryName: string): number;
 /**
  * Read `absPath` in slices, redacting whole lines, invoking `onChunk` with
  * roughly {@link CHUNK_TEXT_BYTES} of redacted text at a time.
@@ -120,7 +145,7 @@ export declare function streamRedactedFile(absPath: string, sizeBytes: number, m
     stopped: boolean;
 }>;
 /**
- * Build a gzipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
+ * Build a zipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
  *
  * Returns `undefined` when nothing eligible exists, so the caller can skip the
  * upload entirely. Never throws: a bug report must not fail over its own

package/dist/utils/feedback-log-bundle.js

@@ -6,7 +6,7 @@
  * body above 64 KiB, and `diagnostics` is written into a DynamoDB item, which
  * caps at 400 KB. Neither can be tuned into carrying a real log history, so the
  * inline blob is deliberately a ~40 KiB summary of 16 KiB tails. This module
- * produces the other half: a gzipped bundle uploaded direct to S3, carrying the
+ * produces the other half: a zipped bundle uploaded direct to S3, carrying the
  * files whole rather than in tail-sized slivers.
  *
  * Three properties are load-bearing and none may be traded away:
@@ -25,17 +25,33 @@
  *   3. BOUNDED MEMORY. 50 MB compressed is roughly a gigabyte of raw log text
  *      at the ratio these files compress at. Nothing is ever fully materialised:
  *      files are read in slices, redacted a line at a time, and streamed into
- *      gzip, with only the compressed output retained.
+ *      the deflate stream, with only the compressed output retained.
  *
- * Output format — gzipped NDJSON, one JSON record per line:
+ * WHY ZIP AND NOT GZIP. This bundle is attached to a Slack thread by the
+ * hq-pro feedback worker, and Slack's `files.completeUploadExternal` refuses a
+ * gzip member from this app at ANY size — a 52-byte gzip was rejected with
+ * `internal_error`, while the same bytes as zip were accepted. That was the
+ * root cause of roughly 110 consecutive silent attachment failures. The worker
+ * carries a gz-to-zip repack so older CLIs still get an attachable bundle;
+ * emitting zip here means the common path never pays for that unpack, and the
+ * archive is the format the destination actually accepts.
+ *
+ * A single deflate member wrapped in a ZIP32 container, one entry. The stream
+ * is raw deflate so the container's own CRC and sizes are the only integrity
+ * record; crc32 is folded in incrementally as lines are written, and the local
+ * header, central directory, and EOCD are assembled once at finish. The size
+ * budget is charged on the container, not the member, so the ~98 bytes of
+ * framing can never be what pushes an upload past the server's ceiling.
+ *
+ * Output format inside the entry — NDJSON, one JSON record per line:
  *   {"kind":"manifest","version":1,...}                    exactly one, first
  *   {"kind":"file","name":"logs/hq-sync.log",...}          one per file
  *   {"kind":"chunk","name":"logs/hq-sync.log","seq":0,...} many per file
  *   {"kind":"summary","fileCount":12,...}                  exactly one, last
  *
- * NDJSON rather than tar so there is no archive dependency, so a truncated
- * bundle is still parseable line-by-line up to the cut, and so the records
- * carry the same redaction metadata the inline blob already reports.
+ * NDJSON inside the entry rather than a tar of separate members, so a
+ * truncated bundle is still parseable line-by-line up to the cut, and so the
+ * records carry the same redaction metadata the inline blob already reports.
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -50,22 +66,29 @@ import { vaultApiFetch } from "./vault-api.js";
  * stay in step or the CLI will build bundles the server will not accept.
  */
 export const LOG_BUNDLE_MAX_BYTES = 50 * 1024 * 1024;
+/**
+ * What the presign request declares, and what the server must answer with.
+ * Mirrors `LOG_BUNDLE_FORMAT_ZIP` / `LOG_BUNDLE_ZIP_CONTENT_TYPE` in the hq-pro
+ * handler `feedback-log-bundles.ts`.
+ */
+const LOG_BUNDLE_FORMAT = "zip";
+const LOG_BUNDLE_CONTENT_TYPE = "application/zip";
 /**
  * Headroom between the size we stop feeding at and the hard cap.
  *
- * gzip reports compressed bytes only as its internal buffer flushes, so the
+ * deflate reports compressed bytes only as its internal buffer flushes, so the
  * running total lags the bytes actually consumed. The lag is bounded by that
  * buffer (tens of KiB); a 1 MiB margin covers it with three orders of magnitude
  * to spare, and the final size is asserted against the real cap regardless.
  */
-export const LOG_BUNDLE_SAFETY_MARGIN_BYTES = 1024 * 1024;
+const LOG_BUNDLE_SAFETY_MARGIN_BYTES = 1024 * 1024;
 /**
  * Per-file raw ceiling. The desktop logger rotates at 32 MiB (hq-desktop-core
  * `logfile.rs`), so this admits a full generation with headroom while stopping
  * one pathological file from consuming the whole bundle. Files above it are
  * read from the TAIL — the end of a log is what explains a failure.
  */
-export const LOG_BUNDLE_MAX_FILE_RAW_BYTES = 64 * 1024 * 1024;
+const LOG_BUNDLE_MAX_FILE_RAW_BYTES = 64 * 1024 * 1024;
 /** Read slice size. Bounds peak memory; unrelated to the output chunking. */
 const READ_SLICE_BYTES = 4 * 1024 * 1024;
 /** Target raw text per emitted chunk record. Keeps NDJSON lines manageable. */
@@ -132,24 +155,171 @@ export function orderBundleCandidates(hqDir) {
     const logs = discoverLogFiles(hqDir).sort((a, b) => b.modifiedMs - a.modifiedMs || a.name.localeCompare(b.name));
     return [...state, ...logs];
 }
-function createGzipSink() {
-    const gzip = zlib.createGzip({ level: 9 });
+/**
+ * Name of the single entry inside the zip. The `.ndjson` extension is what
+ * tells a triager (and `jq`) what is inside once it is unzipped.
+ */
+export const LOG_BUNDLE_ENTRY_NAME = "hq-logs.ndjson";
+/**
+ * ZIP32 stores the uncompressed size in 32 bits, so a bundle whose contents
+ * exceed 4 GiB cannot be described by the container at all.
+ *
+ * The compressed cap does not prevent this. Log text compresses at roughly 24x
+ * in practice but there is no upper bound on the ratio — repetitive logs go
+ * far higher — and discovery admits an unbounded number of files at up to
+ * {@link LOG_BUNDLE_MAX_FILE_RAW_BYTES} each. Collection stops at the line
+ * below and reports `truncated`, which is what the caller already handles;
+ * without it `writeUInt32LE` throws at finish and the outer catch discards the
+ * whole bundle, so the installation with the most logs would send none.
+ */
+const ZIP32_MAX_UNCOMPRESSED_BYTES = 0xffffffff;
+/**
+ * Room left below the ZIP32 ceiling for the chunk in flight plus the closing
+ * summary record. A chunk is written whole before the budget is re-checked.
+ */
+const ZIP32_UNCOMPRESSED_MARGIN_BYTES = 1024 * 1024;
+/** The line collection actually stops at. Never above what ZIP32 can describe. */
+export const ZIP32_UNCOMPRESSED_STOP_BYTES = ZIP32_MAX_UNCOMPRESSED_BYTES - ZIP32_UNCOMPRESSED_MARGIN_BYTES;
+/**
+ * Resolve the entry ceiling a caller asked for. A caller may lower it; nothing
+ * may raise it past what the container can describe, because a ceiling above
+ * the format's limit is not a ceiling at all.
+ */
+export function entryCeiling(requested) {
+    if (requested === undefined || !Number.isFinite(requested)) {
+        return ZIP32_UNCOMPRESSED_STOP_BYTES;
+    }
+    return Math.max(0, Math.min(requested, ZIP32_UNCOMPRESSED_STOP_BYTES));
+}
+/**
+ * crc32 with a fallback, because `zlib.crc32` is newer than this package's
+ * floor: it landed in Node 22.2.0 and was backported only to 20.15.0, while
+ * `engines.node` is `>=20.0.0`. On Node 20.0-20.14 and 21.x the native call is
+ * undefined, the first sink write throws, and `buildLogBundle` catches it and
+ * returns undefined — every report on those runtimes silently loses its log
+ * bundle. The table is built once, on first use, and only when needed.
+ */
+let crcTable = null;
+export function crc32Fallback(buf, seed = 0) {
+    if (!crcTable) {
+        crcTable = new Uint32Array(256);
+        for (let i = 0; i < 256; i++) {
+            let c = i;
+            for (let k = 0; k < 8; k++)
+                c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+            crcTable[i] = c >>> 0;
+        }
+    }
+    let crc = ~seed >>> 0;
+    for (let i = 0; i < buf.length; i++) {
+        crc = (crcTable[(crc ^ buf[i]) & 0xff] ^ (crc >>> 8)) >>> 0;
+    }
+    return (~crc >>> 0) >>> 0;
+}
+/** Exported for the test that proves the fallback agrees with the native one. */
+function crc32(buf, seed = 0) {
+    const native = zlib.crc32;
+    return typeof native === "function" ? native(buf, seed) : crc32Fallback(buf, seed);
+}
+/** Local file header, central directory header, and EOCD signatures. */
+const ZIP_LOCAL_SIG = 0x04034b50;
+const ZIP_CENTRAL_SIG = 0x02014b50;
+const ZIP_EOCD_SIG = 0x06054b50;
+/** Deflate, no data descriptor: sizes and CRC are known before a header is written. */
+const ZIP_METHOD_DEFLATE = 8;
+const ZIP_VERSION = 20;
+/**
+ * A fixed MS-DOS timestamp, so the same logs produce the same bytes.
+ *
+ * Deliberately not the wall clock: a bundle's timing lives in the manifest
+ * record, which is redacted content the recipient can read, rather than in
+ * archive metadata that no tool here surfaces. 0x0021 is 1980-01-01, the
+ * earliest the format can represent.
+ */
+const ZIP_DOS_TIME = 0;
+const ZIP_DOS_DATE = 0x0021;
+/**
+ * Bytes of ZIP framing around one entry: local header, central directory
+ * header, end-of-central-directory. The name is stored twice.
+ */
+export function zipOverheadBytes(entryName) {
+    return 30 + 46 + 22 + Buffer.byteLength(entryName, "utf8") * 2;
+}
+function createZipSink(entryName = LOG_BUNDLE_ENTRY_NAME, maxUncompressed = ZIP32_UNCOMPRESSED_STOP_BYTES) {
+    const name = Buffer.from(entryName, "utf8");
+    const deflate = zlib.createDeflateRaw({ level: 9 });
     const parts = [];
+    const overhead = zipOverheadBytes(entryName);
     let compressed = 0;
+    let uncompressed = 0;
+    let crc = 0;
     let failure = null;
-    gzip.on("data", (chunk) => {
+    deflate.on("data", (chunk) => {
         parts.push(chunk);
         compressed += chunk.byteLength;
     });
-    gzip.on("error", (err) => {
+    deflate.on("error", (err) => {
         failure = err;
     });
+    function container(body) {
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(ZIP_LOCAL_SIG, 0);
+        local.writeUInt16LE(ZIP_VERSION, 4);
+        local.writeUInt16LE(0, 6); // flags
+        local.writeUInt16LE(ZIP_METHOD_DEFLATE, 8);
+        local.writeUInt16LE(ZIP_DOS_TIME, 10);
+        local.writeUInt16LE(ZIP_DOS_DATE, 12);
+        local.writeUInt32LE(crc >>> 0, 14);
+        local.writeUInt32LE(body.byteLength, 18);
+        local.writeUInt32LE(uncompressed, 22);
+        local.writeUInt16LE(name.byteLength, 26);
+        local.writeUInt16LE(0, 28); // extra length
+        const central = Buffer.alloc(46);
+        central.writeUInt32LE(ZIP_CENTRAL_SIG, 0);
+        central.writeUInt16LE(ZIP_VERSION, 4); // version made by
+        central.writeUInt16LE(ZIP_VERSION, 6); // version needed
+        central.writeUInt16LE(0, 8); // flags
+        central.writeUInt16LE(ZIP_METHOD_DEFLATE, 10);
+        central.writeUInt16LE(ZIP_DOS_TIME, 12);
+        central.writeUInt16LE(ZIP_DOS_DATE, 14);
+        central.writeUInt32LE(crc >>> 0, 16);
+        central.writeUInt32LE(body.byteLength, 20);
+        central.writeUInt32LE(uncompressed, 24);
+        central.writeUInt16LE(name.byteLength, 28);
+        central.writeUInt16LE(0, 30); // extra
+        central.writeUInt16LE(0, 32); // comment
+        central.writeUInt16LE(0, 34); // disk number start
+        central.writeUInt16LE(0, 36); // internal attrs
+        central.writeUInt32LE(0, 38); // external attrs
+        central.writeUInt32LE(0, 42); // local header offset
+        const centralSize = central.byteLength + name.byteLength;
+        const centralOffset = local.byteLength + name.byteLength + body.byteLength;
+        const eocd = Buffer.alloc(22);
+        eocd.writeUInt32LE(ZIP_EOCD_SIG, 0);
+        eocd.writeUInt16LE(0, 4); // this disk
+        eocd.writeUInt16LE(0, 6); // disk with central dir
+        eocd.writeUInt16LE(1, 8); // entries on this disk
+        eocd.writeUInt16LE(1, 10); // entries total
+        eocd.writeUInt32LE(centralSize, 12);
+        eocd.writeUInt32LE(centralOffset, 16);
+        eocd.writeUInt16LE(0, 20); // comment length
+        return Buffer.concat([local, name, body, central, name, eocd]);
+    }
     return {
-        compressedBytes: () => compressed,
+        // The budget is charged on what will be PUT, framing included, so the
+        // container can never be what carries the upload over the server's cap.
+        compressedBytes: () => overhead + compressed,
+        atUncompressedLimit: () => uncompressed > maxUncompressed,
         write: (line) => new Promise((resolve, reject) => {
             if (failure)
                 return reject(failure);
-            gzip.write(line, "utf8", (err) => (err ? reject(err) : resolve()));
+            const buf = Buffer.from(line, "utf8");
+            // Folded in as we go: the whole point of this module is that the
+            // uncompressed text is never materialised, so there is nothing to
+            // checksum at the end.
+            crc = crc32(buf, crc);
+            uncompressed += buf.byteLength;
+            deflate.write(buf, (err) => (err ? reject(err) : resolve()));
         }),
         // Z_SYNC_FLUSH costs a handful of bytes per boundary and a little ratio.
         // That is the price of a budget that is enforced rather than estimated:
@@ -159,13 +329,13 @@ function createGzipSink() {
         sync: () => new Promise((resolve, reject) => {
             if (failure)
                 return reject(failure);
-            gzip.flush(zlib.constants.Z_SYNC_FLUSH, () => resolve());
+            deflate.flush(zlib.constants.Z_SYNC_FLUSH, () => resolve());
         }),
         finish: () => new Promise((resolve, reject) => {
-            gzip.on("end", () => (failure ? reject(failure) : resolve(Buffer.concat(parts))));
-            gzip.on("error", reject);
-            gzip.end();
-            gzip.resume();
+            deflate.on("end", () => failure ? reject(failure) : resolve(container(Buffer.concat(parts))));
+            deflate.on("error", reject);
+            deflate.end();
+            deflate.resume();
         }),
     };
 }
@@ -268,7 +438,7 @@ export async function streamRedactedFile(absPath, sizeBytes, maxRawBytes, chunkB
     }
 }
 /**
- * Build a gzipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
+ * Build a zipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
  *
  * Returns `undefined` when nothing eligible exists, so the caller can skip the
  * upload entirely. Never throws: a bug report must not fail over its own
@@ -294,7 +464,7 @@ export async function buildLogBundle(opts = {}) {
     if (candidates.length === 0)
         return undefined;
     try {
-        const sink = createGzipSink();
+        const sink = createZipSink(LOG_BUNDLE_ENTRY_NAME, entryCeiling(opts.maxEntryBytes));
         let fileCount = 0;
         let rawBytes = 0;
         let redactions = 0;
@@ -309,7 +479,7 @@ export async function buildLogBundle(opts = {}) {
         }));
         for (const candidate of candidates) {
             await sink.sync();
-            if (sink.compressedBytes() > stopAt) {
+            if (sink.compressedBytes() > stopAt || sink.atUncompressedLimit()) {
                 truncated = true;
                 break;
             }
@@ -334,7 +504,7 @@ export async function buildLogBundle(opts = {}) {
                     // Stop feeding once the compressed total reaches the stop line.
                     // The sync is what makes that total trustworthy.
                     await sink.sync();
-                    return sink.compressedBytes() <= stopAt;
+                    return sink.compressedBytes() <= stopAt && !sink.atUncompressedLimit();
                 });
                 stopped = result.stopped;
             }
@@ -349,18 +519,18 @@ export async function buildLogBundle(opts = {}) {
             }
         }
         await sink.write(record({ kind: "summary", fileCount, rawBytes, redactions, truncated }));
-        const gzip = await sink.finish();
+        const bytes = await sink.finish();
         // Nothing but a manifest and a summary is not worth uploading.
         if (fileCount === 0)
             return undefined;
         // Final authority. The stop line plus margin should make this unreachable,
         // but the server refuses to presign above the cap, so a bundle that
         // overshot is useless and must not be offered.
-        if (gzip.byteLength > maxBytes)
+        if (bytes.byteLength > maxBytes)
             return undefined;
         return {
-            gzip,
-            sizeBytes: gzip.byteLength,
+            bytes,
+            sizeBytes: bytes.byteLength,
             fileCount,
             truncated,
             rawBytes,
@@ -395,7 +565,10 @@ export async function uploadLogBundle(opts) {
             token: opts.token,
             path: "/v1/feedback/logs/presign",
             method: "POST",
-            body: { sizeBytes: bundle.sizeBytes },
+            // The server owns the key and the signed content type, so it has to be
+            // told which format is coming; without this it mints a `.ndjson.gz` slot
+            // signed `application/gzip` and the PUT would be a lie on both counts.
+            body: { sizeBytes: bundle.sizeBytes, format: LOG_BUNDLE_FORMAT },
         });
         if (!res.ok)
             return undefined;
@@ -404,15 +577,22 @@ export async function uploadLogBundle(opts) {
         if (!slot || typeof slot.key !== "string" || typeof slot.url !== "string") {
             return undefined;
         }
+        // A server too old to know about `format` answers with a gzip slot. Its
+        // signature binds `application/gzip` and its key claims `.gz`, and these
+        // bytes are neither. Skipping is the honest outcome and costs only the
+        // bundle — the submission still carries the inline logs, which is exactly
+        // what happens when bundles are disabled entirely.
+        if (slot.contentType !== LOG_BUNDLE_CONTENT_TYPE)
+            return undefined;
         const doFetch = opts.fetchImpl ?? fetch;
         const put = await doFetch(slot.url, {
             method: "PUT",
             headers: {
-                "Content-Type": typeof slot.contentType === "string" ? slot.contentType : "application/gzip",
+                "Content-Type": slot.contentType,
                 // Must match the length bound into the signature, or S3 rejects it.
                 "Content-Length": String(bundle.sizeBytes),
             },
-            body: new Uint8Array(bundle.gzip),
+            body: new Uint8Array(bundle.bytes),
         });
         if (!put.ok)
             return undefined;

package/dist/utils/feedback-logs.d.ts

@@ -13,8 +13,9 @@
  *     (`hq-sync.log.1`, `.2`, `.3`) are eligible too — just after a rotation
  *     the active file is nearly empty and the history lives in `.1`.
  *     `logs/mcp-registry.log` is the CLI's own append-only MCP audit trail.
- *     Any future `*.log`/`*.jsonl` dropped into `~/.hq/logs/` is picked up
- *     automatically.
+ *     The daemon runner's `daemon/logs/sync.log` and its three rotations are
+ *     eligible too. When both sync families exist, only the newer family is
+ *     attached.
  *
  *   - STATE SNAPSHOTS (`state`) — small JSON files that describe where sync
  *     and client health currently stand: the in-flight sync phase and conflict
@@ -36,8 +37,9 @@
  *
  *   1. ALLOWLIST, NOT A SCAN. `~/.hq` also holds `cognito-tokens.json`,
  *      `deploy-passwords.json`, and `secrets-cache/`. Only `*.log` files
- *      directly inside `~/.hq/logs/` plus the two known root-level boot logs
- *      are ever eligible. A recursive walk over `~/.hq` is a credential leak
+ *      directly inside `~/.hq/logs/`, the exact daemon sync-log generations
+ *      under the configured daemon root, and the two known root-level boot
+ *      logs are eligible. A recursive walk over `~/.hq` is a credential leak
  *      and must never be introduced here.
  *
  *   2. NO SYMLINKS. Eligibility is decided with `lstat`, and a candidate must
@@ -82,13 +84,6 @@ export declare const FEEDBACK_LOGS_MIN_USEFUL_BYTES = 1024;
  * evidence. The overflow count preserves the signal without the bytes.
  */
 export declare const FEEDBACK_MAX_SKIPPED_ENTRIES = 25;
-/** Subdirectory of `~/.hq` whose log files are eligible. Not recursive. */
-export declare const FEEDBACK_LOGS_DIRNAME = "logs";
-/**
- * Eligible extensions inside `~/.hq/logs/`. `.jsonl` is included because the
- * CLI's MCP registry audit trail is JSON-lines, not plain text.
- */
-export declare const FEEDBACK_LOG_EXTENSIONS: readonly string[];
 /**
  * True for a log filename, including a ROTATED generation.
  *
@@ -101,26 +96,6 @@ export declare const FEEDBACK_LOG_EXTENSIONS: readonly string[];
 export declare function isEligibleLogName(name: string): boolean;
 /** Per-state-file ceiling. These are status documents, not streams. */
 export declare const FEEDBACK_STATE_MAX_FILE_BYTES: number;
-/**
- * Ceiling on all state snapshots combined. Deliberately a small slice of the
- * overall budget: state is dense but finite, and the rest belongs to logs.
- */
-export declare const FEEDBACK_STATE_MAX_TOTAL_BYTES: number;
-/**
- * State files at the `~/.hq` ROOT that are eligible, by EXACT name.
- *
- * The root is where `cognito-tokens.json`, `deploy-passwords.json`, and
- * `secrets-cache/` live, so it is never globbed. Adding a name here is a
- * deliberate act: confirm the file carries no credential before listing it.
- */
-export declare const FEEDBACK_STATE_FILENAMES: readonly string[];
-/**
- * Per-company sync journal LOCATORS (`sync-journal.<slug>.json`) are also
- * eligible. Matched by an exact prefix AND a `.json` suffix, which is what
- * excludes the multi-hundred-megabyte `…json.last-good` snapshots sitting
- * beside them. No credential file at the root carries this prefix.
- */
-export declare const FEEDBACK_STATE_JOURNAL_PREFIX = "sync-journal.";
 /**
  * `~/.hq/locks/` — held operation locks and background-work claims.
  *
@@ -139,8 +114,6 @@ export declare const FEEDBACK_LOCKS_DIRNAME = "locks";
  * bounds that walk carries.
  */
 export declare const FEEDBACK_JOBS_DIRNAME = "jobs";
-/** Per-entry ceiling for a lock file. Their value is the name plus a little context. */
-export declare const FEEDBACK_LOCK_MAX_FILE_BYTES = 512;
 /**
  * Bounds on the `jobs/` walk. Depth 3 reaches
  * `jobs/probes/<job>/last-attempt.json`; the file cap stops a pathological
@@ -150,15 +123,9 @@ export declare const FEEDBACK_JOBS_MAX_DEPTH = 3;
 export declare const FEEDBACK_JOBS_MAX_FILES = 20;
 /** Ceiling on how many lock entries are collected. */
 export declare const FEEDBACK_LOCKS_MAX_FILES = 20;
-/**
- * Log files that live at the root of `~/.hq` rather than under `logs/`.
- * Listed explicitly — the root directory holds credentials and must never be
- * enumerated by pattern.
- */
-export declare const FEEDBACK_ROOT_LOG_FILENAMES: readonly string[];
 /** Why a discovered log file contributed nothing to the submission. */
-export type SkipReason = "budget" | "empty" | "unreadable";
-export interface LogTail {
+type SkipReason = "budget" | "empty" | "unreadable";
+interface LogTail {
     /** Path relative to `~/.hq`, e.g. `logs/hq-sync.log`. Never absolute. */
     name: string;
     /** Full on-disk size, even when only a tail was included. */
@@ -175,7 +142,7 @@ export interface LogTail {
     tail: string;
 }
 /** A small JSON status document included whole (or head-truncated). */
-export interface StateSnapshot {
+interface StateSnapshot {
     /** Path relative to `~/.hq`, e.g. `sync-progress.json`. Never absolute. */
     name: string;
     sizeBytes: number;
@@ -235,12 +202,13 @@ export declare function feedbackLogsEnabled(env?: NodeJS.ProcessEnv): boolean;
  * Enumerate eligible log files under `hqDir`.
  *
  * Eligibility is the allowlist described in the module header: `*.log` files
- * directly inside `hqDir/logs/`, plus {@link FEEDBACK_ROOT_LOG_FILENAMES} at
- * the root. Every candidate must be a REGULAR file by `lstat` — directories
- * and, critically, symlinks are rejected. Returned newest-modified first so
- * the most relevant log is offered the budget before older ones.
+ * directly inside `hqDir/logs/`, the exact daemon sync-log generations, plus
+ * {@link FEEDBACK_ROOT_LOG_FILENAMES} at the root. Every candidate must be a
+ * REGULAR file by `lstat` — directories and, critically, symlinks are rejected.
+ * Returned newest-modified first so the most relevant log is offered budget
+ * before older ones.
  */
-export declare function discoverLogFiles(hqDir: string): LogCandidate[];
+export declare function discoverLogFiles(hqDir: string, env?: NodeJS.ProcessEnv): LogCandidate[];
 /**
  * Read the last `maxBytes` of a file.
  *
@@ -314,6 +282,8 @@ export interface CollectFeedbackLogsOptions {
     hqDir?: string;
     /** Override the home directory used to derive `~/.hq` (tests). */
     homeDir?: string;
+    /** Override process environment for configured log paths (tests). */
+    env?: NodeJS.ProcessEnv;
 }
 /**
  * Collect redacted `~/.hq` evidence within `budgetBytes`.
@@ -326,4 +296,5 @@ export interface CollectFeedbackLogsOptions {
  * omit the field entirely rather than attach an empty object. Never throws.
  */
 export declare function collectFeedbackLogs(opts?: CollectFeedbackLogsOptions): FeedbackLogsBlob | undefined;
+export {};
 //# sourceMappingURL=feedback-logs.d.ts.map