@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/auth.d.ts

@@ -6,6 +6,7 @@
  *   hq auth logout    — clear the cached HQ session
  *   hq auth refresh   — ensure a valid cached Cognito session (non-interactive)
  *   hq auth status    — show whether a valid session is cached + expiry
+ *   hq auth machine-session --output <path> — write machine tokens to a private file
  *
  * Sign-up is owned by the onboarding web app at
  * https://onboarding.hq.computer. `hq auth login` signs an existing account

package/dist/commands/auth.js

@@ -6,6 +6,7 @@
  *   hq auth logout    — clear the cached HQ session
  *   hq auth refresh   — ensure a valid cached Cognito session (non-interactive)
  *   hq auth status    — show whether a valid session is cached + expiry
+ *   hq auth machine-session --output <path> — write machine tokens to a private file
  *
  * Sign-up is owned by the onboarding web app at
  * https://onboarding.hq.computer. `hq auth login` signs an existing account
@@ -13,34 +14,114 @@
  * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
  */
+import * as fs from "node:fs";
+import { open, realpath } from "node:fs/promises";
+import path from "node:path";
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
-import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
-import { cognitoConfigForLoginProvider } from "../utils/login-provider.js";
+import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, } from "../utils/cognito-session.js";
+import { resolveLoginProviderSelection, } from "../utils/login-provider.js";
+import { getLastLoginProviderStatePath, loadLastLoginProvider, storeLastLoginProvider, } from "../lib/auth-login-provider-state.js";
 import { callbackPortBusyGuidance, DEFAULT_CALLBACK_PORT, isCallbackPortBusy, } from "../utils/callback-port-busy.js";
-/**
- * Decode the (unverified) ID token payload for display purposes only.
- * The token was just returned by Cognito's token endpoint, so its contents
- * are trusted enough to print — we never use these claims for authorization.
- */
-function peekIdToken(idToken) {
+/** Decode token claims for local display and provider-memory purposes only. */
+function decodeIdTokenClaims(idToken) {
     try {
         const payload = idToken.split(".")[1];
         if (!payload)
-            return {};
+            return undefined;
         const pad = payload.length % 4 === 0 ? "" : "=".repeat(4 - (payload.length % 4));
         const normalized = payload.replace(/-/g, "+").replace(/_/g, "/") + pad;
         const decoded = JSON.parse(Buffer.from(normalized, "base64").toString("utf-8"));
-        return {
-            email: decoded.email,
-            sub: decoded.sub,
-            entityType: decoded["custom:entityType"],
-            entityUid: decoded["custom:entityUid"],
-        };
+        return decoded && typeof decoded === "object" && !Array.isArray(decoded)
+            ? decoded
+            : undefined;
     }
     catch {
-        return {};
+        return undefined;
+    }
+}
+function formatAuthExpiry(expiresAt, now = Date.now()) {
+    const expiresAtMs = typeof expiresAt === "number" ? expiresAt : Date.parse(expiresAt);
+    const expiresAtDate = new Date(expiresAtMs);
+    if (!Number.isFinite(expiresAtMs) || Number.isNaN(expiresAtDate.getTime())) {
+        return String(expiresAt);
+    }
+    const remainingMs = expiresAtMs - now;
+    const absoluteMs = Math.abs(remainingMs);
+    let unit;
+    let unitMs;
+    if (absoluteMs >= 365 * 24 * 60 * 60 * 1_000) {
+        unit = "year";
+        unitMs = 365 * 24 * 60 * 60 * 1_000;
+    }
+    else if (absoluteMs >= 30 * 24 * 60 * 60 * 1_000) {
+        unit = "month";
+        unitMs = 30 * 24 * 60 * 60 * 1_000;
+    }
+    else if (absoluteMs >= 24 * 60 * 60 * 1_000) {
+        unit = "day";
+        unitMs = 24 * 60 * 60 * 1_000;
     }
+    else if (absoluteMs >= 60 * 60 * 1_000) {
+        unit = "hour";
+        unitMs = 60 * 60 * 1_000;
+    }
+    else if (absoluteMs >= 60 * 1_000) {
+        unit = "minute";
+        unitMs = 60 * 1_000;
+    }
+    else {
+        unit = "second";
+        unitMs = 1_000;
+    }
+    const relative = new Intl.RelativeTimeFormat("en", { numeric: "always" })
+        .format(Math.round(remainingMs / unitMs), unit);
+    return expiresAtDate.toISOString() + " (" + relative + ")";
+}
+function peekIdToken(idToken) {
+    const claims = decodeIdTokenClaims(idToken);
+    return {
+        email: typeof claims?.email === "string" ? claims.email : undefined,
+        sub: typeof claims?.sub === "string" ? claims.sub : undefined,
+        entityType: typeof claims?.["custom:entityType"] === "string"
+            ? claims["custom:entityType"]
+            : undefined,
+        entityUid: typeof claims?.["custom:entityUid"] === "string"
+            ? claims["custom:entityUid"]
+            : undefined,
+    };
+}
+function errorCode(error) {
+    if (error
+        && typeof error === "object"
+        && "code" in error
+        && typeof error.code === "string") {
+        return error.code;
+    }
+    return "UNKNOWN";
+}
+function providerFromIdToken(idToken) {
+    const identities = decodeIdTokenClaims(idToken)?.identities;
+    if (!Array.isArray(identities))
+        return undefined;
+    const providers = new Set();
+    for (const identity of identities) {
+        if (!identity || typeof identity !== "object" || Array.isArray(identity))
+            continue;
+        const item = identity;
+        const providerName = typeof item.providerName === "string"
+            ? item.providerName
+            : item.providerType;
+        if (typeof providerName !== "string")
+            continue;
+        const normalized = providerName.trim().toLowerCase();
+        if (normalized === "google")
+            providers.add("google");
+        if (normalized === "microsoft" || normalized === "microsoftpersonal") {
+            providers.add("microsoft");
+        }
+    }
+    return providers.size === 1 ? providers.values().next().value : undefined;
 }
 /** Display label for the local machine identity (company agents). */
 function machineIdentityLabel() {
@@ -51,6 +132,77 @@ export function registerAuthCommands(program) {
     const authCmd = program
         .command("auth")
         .description("Manage the local HQ Cognito session");
+    authCmd
+        .command("machine-session")
+        .description("Write the existing machine identity session to a private file")
+        .requiredOption("--output <path>", "path for the private machine session JSON")
+        .action(async (options) => {
+        const requestedPath = path.resolve(options.output);
+        let handle;
+        try {
+            if (!loadMachineCreds()) {
+                throw new Error("Machine credentials are unavailable.");
+            }
+            const outputDirectory = await realpath(path.dirname(requestedPath));
+            const outputPath = path.join(outputDirectory, path.basename(requestedPath));
+            const protectedPaths = await Promise.all([personTokenCacheFile(), machineTokenCacheFile()].map(async (protectedPath) => {
+                const resolved = path.resolve(protectedPath);
+                try {
+                    return path.join(await realpath(path.dirname(resolved)), path.basename(resolved));
+                }
+                catch (error) {
+                    if (error.code === "ENOENT")
+                        return resolved;
+                    throw error;
+                }
+            }));
+            if (protectedPaths.includes(outputPath)) {
+                throw new Error("Refusing to overwrite a cached Cognito session.");
+            }
+            const tokens = await ensureMachineSessionTokens();
+            const contents = JSON.stringify({
+                accessToken: tokens.accessToken,
+                idToken: tokens.idToken,
+                expiresAt: tokens.expiresAt,
+            }) + "\n";
+            try {
+                handle = await open(outputPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+                    (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                handle = await open(outputPath, fs.constants.O_WRONLY | (fs.constants.O_NOFOLLOW ?? 0));
+                const metadata = await handle.stat();
+                if (!metadata.isFile() ||
+                    metadata.uid !== process.getuid?.() ||
+                    (metadata.mode & 0o077) !== 0) {
+                    throw new Error("Existing output file is not a private file owned by this user.");
+                }
+                await handle.truncate(0);
+            }
+            await handle.writeFile(contents, { encoding: "utf8" });
+            await handle.close();
+            handle = undefined;
+        }
+        catch (error) {
+            if (handle)
+                await handle.close().catch(() => undefined);
+            const code = error && typeof error === "object" && "code" in error &&
+                typeof error.code === "string" && /^[A-Z0-9_]+$/.test(error.code)
+                ? error.code
+                : undefined;
+            console.error(code === "EACCES" || code === "ELOOP" || code === "EEXIST"
+                ? "Could not write machine session file (unsafe or inaccessible path)."
+                : error instanceof Error && error.message === "Machine credentials are unavailable."
+                    ? "Machine credentials are unavailable."
+                    : error instanceof Error && (error.message === "Existing output file is not a private file owned by this user." ||
+                        error.message === "Refusing to overwrite a cached Cognito session.")
+                        ? error.message
+                        : "Could not obtain or write machine session.");
+            process.exitCode = 1;
+        }
+    });
     authCmd
         .command("login")
         .description("Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally")
@@ -67,7 +219,25 @@ export function registerAuthCommands(program) {
             return;
         }
         try {
-            const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
+            const canUseRememberedProvider = options.provider === undefined
+                && process.env.HQ_COGNITO_IDENTITY_PROVIDER === undefined;
+            let rememberedProvider;
+            if (canUseRememberedProvider) {
+                try {
+                    rememberedProvider = loadLastLoginProvider();
+                }
+                catch (error) {
+                    console.error(chalk.dim(`Could not read provider state at ${getLastLoginProviderStatePath()} (${errorCode(error)}). Continuing to the provider choice page.`));
+                }
+            }
+            const selection = resolveLoginProviderSelection(options.provider, process.env, rememberedProvider);
+            const tokens = await browserLogin(selection.config);
+            try {
+                storeLastLoginProvider(providerFromIdToken(tokens.idToken) ?? selection.providerToRemember);
+            }
+            catch (error) {
+                console.error(chalk.dim(`Could not save provider state at ${getLastLoginProviderStatePath()} (${errorCode(error)}). The provider choice was not saved.`));
+            }
             const who = peekIdToken(tokens.idToken).email ?? "HQ";
             console.log(chalk.green(`Signed in as ${who}`));
             console.log(chalk.dim(`  Token cached at ~/.hq/cognito-tokens.json (expires ${tokens.expiresAt})`));
@@ -144,8 +314,8 @@ export function registerAuthCommands(program) {
         const expiring = isExpiring(cached);
         const label = who ? `${who} — ` : "";
         console.log(expiring
-            ? chalk.yellow(`${label}HQ session cached but expiring (expiresAt=${cached.expiresAt})`)
-            : chalk.green(`${label}HQ session valid (expiresAt=${cached.expiresAt})`));
+            ? chalk.yellow(`${label}HQ session cached but expiring (expiresAt=${formatAuthExpiry(cached.expiresAt)})`)
+            : chalk.green(`${label}HQ session valid (expiresAt=${formatAuthExpiry(cached.expiresAt)})`));
         console.log(chalk.dim(`token source: ${tokenSource}`));
     });
 }

package/dist/commands/billing-sponsor.d.ts

@@ -0,0 +1,83 @@
+/**
+ * `hq billing sponsor` — the individual-pull half of plan sponsorship, from the
+ * terminal ("ask a company to sponsor me", hq-pro #3609).
+ *
+ * A person who is over a personal limit has exactly three ways out: pay $50
+ * themselves, reduce what they store, or ask a company to cover the $50 plan
+ * line. This command is the third one, plus the admin side that answers it.
+ *
+ *   hq billing sponsor request <company>   — ask that company to cover my plan
+ *   hq billing sponsor list                — the queue (admins), or my own
+ *                                            single status (everyone else)
+ *   hq billing sponsor approve <id>        — admin: say yes
+ *   hq billing sponsor decline <id>        — admin: say no
+ *   hq billing sponsor revoke  <id>        — admin: end an active sponsorship
+ *   hq billing sponsor withdraw <id>       — me: take back my own request
+ *
+ * Every subcommand talks to the SAME hq-pro routes the console uses
+ * (`/v1/billing/sponsorship/...`). hq-pro is the authoritative gate on all of
+ * them: it resolves the caller's person id and the company's admin set
+ * server-side, so nothing here is trusted from the client.
+ *
+ * FEATURE SWITCH. The `plan` request kind only exists while hq-pro's
+ * `PLAN_SPONSORSHIP_REQUESTS_ENABLED` switch is on. With the switch off the
+ * backend does not recognise `plan` and answers 400 `MISSING_FIELDS` — which
+ * would read as "you typed something wrong". We translate that one case into a
+ * plain "not available yet" line so a person never sees a validation error for
+ * a feature that simply is not turned on.
+ */
+import { Command } from "commander";
+/** The request kind this command files. Matches hq-pro's contract. */
+export declare const PLAN_RESOURCE: "plan";
+/** What a person is told when hq-pro's plan-sponsorship switch is off. */
+export declare const FEATURE_OFF_MESSAGE = "Asking a company to sponsor your plan isn't available yet.";
+/** What v1 sponsorship covers, stated wherever a person confirms or reads it. */
+export declare const COVERAGE_SENTENCE = "Your company pays your $50 plan. Storage above your plan's allowance is still yours.";
+/** What a person is told while an approval waits on the sponsor's card. */
+export declare const HELD_FOR_CARD_SENTENCE = "Your company said yes and is adding a card. Your limits still apply until then.";
+/** One request row as hq-pro persists and returns it. */
+export interface SponsorshipRequestRecord {
+    requestId: string;
+    companyUid: string;
+    requestedBy: string;
+    resourceId?: string;
+    resource: "outpost" | "agent" | "plan";
+    status: "pending" | "active" | "declined" | "pending-sponsor-billing" | "expired";
+    payer: "person" | "company";
+    requestedAt: string;
+    updatedAt: string;
+}
+/** An hq-pro error body: `{ error, code }` on every non-2xx these routes send. */
+interface ApiErrorBody {
+    error?: string;
+    message?: string;
+    code?: string;
+}
+/**
+ * Turn an hq-pro non-2xx into one plain sentence.
+ *
+ * The switch-off 400 is the important translation: with the feature off,
+ * `plan` is an unrecognised resource kind and the generic body reads
+ * "companyUid and resource ('outpost'|'agent') are required", which tells a
+ * person nothing true about what happened.
+ */
+export declare function messageForError(status: number, body: ApiErrorBody): string;
+/**
+ * The member self-read's shape. hq-pro answers
+ * `GET /v1/billing/sponsorship/mine?companyUid=…&resource=…` with ONE status —
+ * not a list — because the route is a self-scoped "am I covered" question.
+ * `active` is true only for an approved COMPANY-paid row; everything else
+ * (never asked, still pending, declined) comes back `active: false` with null
+ * fields.
+ */
+export interface SponsorshipSelfState {
+    active: boolean;
+    status: string | null;
+    payer: "person" | "company" | null;
+    requestId: string | null;
+}
+/** Plain label for a request status. Never shows the raw enum. */
+export declare function statusLabel(status: string): string;
+export declare function registerBillingSponsorCommands(billing: Command): void;
+export {};
+//# sourceMappingURL=billing-sponsor.d.ts.map