@indigoai-us/hq-cli 5.345.156 → 5.345.160

package/dist/commands/dm.js

@@ -7,6 +7,8 @@ import { peekIdToken } from "../utils/id-token.js";
 import { redactAgentInboxItem as redactInboxCredentials } from "../lib/agent-kit/inbox-redact.js";
 import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN } from "../lib/notify-recipient.js";
 import { dmForwardCliEnabled } from "./dm-forward-flag.js";
+import { attachmentScopeForChannel, formatUploadedAttachments, personalScopeForCaller, uploadDmAttachments, validateAttachmentPaths, } from "./dm-attach.js";
+import { ChannelNotFoundError, suggestChannels, withChannelSuggestions, } from "./channel-suggest.js";
 /**
  * Classify a recipient arg as an email or a person/agent uid. Mirrors the
  * email/uid heuristic used by `hq members`. Returns null for neither.
@@ -108,7 +110,57 @@ export function matchChannelsByName(channels, name) {
         return false;
     });
 }
-// ─── Channel @mentions ───────────────────────────────────────────────────────
+/**
+ * Find the single contact whose display name (case-insensitive, or by slug)
+ * equals a bare recipient name. Email local parts are not matched: they are not
+ * the name the user sees, and matching them would divert channel posts. A bare word like `setup` used
+ * to go straight to a channel lookup, so `hq dm send setup` landed in a channel
+ * whose slug was `setup` even when a person by that name existed (feedback
+ * eba06f59). Returns null when nothing or more than one contact matches. Pure.
+ */
+export function matchContactByName(contacts, name) {
+    const target = name.trim().toLowerCase();
+    const targetSlug = channelSlug(name);
+    if (!target)
+        return null;
+    const hits = contacts.filter((c) => {
+        if (!c.personUid)
+            return false;
+        const dn = c.displayName?.trim().toLowerCase();
+        return Boolean(dn && (dn === target || (targetSlug && channelSlug(dn) === targetSlug)));
+    });
+    const unique = [...new Map(hits.map((c) => [c.personUid, c])).values()];
+    return unique.length === 1 ? unique[0] : null;
+}
+async function fetchContacts(token) {
+    try {
+        const res = await vaultApiFetch({ token, path: "/v1/notify/contacts" });
+        if (!res.ok)
+            return [];
+        const data = (await res.json());
+        return Array.isArray(data.contacts) ? data.contacts : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The confirmation line for a channel send. When the typed target is not the
+ * channel's own display name (for example `hq dm setup` matching a channel
+ * whose slug is `setup` but whose display name is `welcome`), say what it
+ * resolved to: the typed text, the channel's scope, and its id. Pure.
+ */
+export function formatChannelPostedLine(channel, typed) {
+    const bareTyped = typed.trim().replace(/^#/, "");
+    const base = `Message posted to #${channel.name ?? bareTyped}`;
+    const typedSlug = channelSlug(bareTyped);
+    const nameSlug = channel.name ? channelSlug(channel.name) : typedSlug;
+    if (typedSlug === nameSlug)
+        return `${base}.`;
+    const scope = channel.scope ? `${channel.scope} channel` : "channel";
+    return `${base} (resolved '${bareTyped}' to ${scope} ${channel.channelId}).`;
+}
+// ─── Channel @mentions───────────────────────────────────────────────────────
 //
 // HQ Rooms mentions are STRUCTURED ONLY: the server never parses `@name` out of
 // the message body (see hq-pro src/vault-service/lib/room-agent-delivery.ts and
@@ -298,13 +350,18 @@ export function buildDmBody(args) {
     if (!rcpt) {
         throw new Error(`Invalid recipient '${args.recipient}': must be an email address, a personUid (prs_…), or an agentUid (agt_…).`);
     }
+    const attachments = args.attachments ?? [];
     const body = (args.message ?? "").trim();
-    if (!body) {
+    // The server accepts an empty body when the message carries attachments.
+    if (!body && attachments.length === 0) {
         throw new Error("A message body is required: hq dm <recipient> <message>");
     }
     if (args.at && args.inDelay) {
         throw new Error("Use only one of --at or --in, not both.");
     }
+    if ((args.at || args.inDelay) && attachments.length > 0) {
+        throw new Error("--attach cannot be combined with a scheduled send (--at/--in); send the file now or schedule the text alone.");
+    }
     let deliverAt;
     if (args.at) {
         const when = new Date(args.at);
@@ -336,8 +393,36 @@ export function buildDmBody(args) {
         ...(details ? { details } : {}),
         ...(deliverAt ? { deliverAt } : {}),
         ...(audience ? { audience } : {}),
+        ...(attachments.length > 0 ? { attachments } : {}),
     };
 }
+/**
+ * The other participant's uid for a 1:1 DM attachment key. A `prs_`/`agt_`
+ * recipient is already a uid; an email is looked up in the caller's contacts
+ * (GET /v1/notify/contacts), the same route `dm forward --from <email>` uses.
+ * There is no separate "person by email" route on the vault API, and a DM to
+ * someone outside your contacts is a connection request anyway, which the
+ * server holds without delivering files.
+ */
+export async function resolveDmPeerUid(token, recipient) {
+    const rcpt = detectRecipient(recipient);
+    if (!rcpt)
+        throw new Error(`Invalid recipient '${recipient}'.`);
+    if (rcpt.toPersonUid)
+        return rcpt.toPersonUid;
+    const email = rcpt.toEmail.toLowerCase();
+    const res = await vaultApiFetch({ token, path: "/v1/notify/contacts" });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new Error(friendlyDmError(res.status, err.code, err.error ?? err.message ?? res.statusText));
+    }
+    const data = (await res.json());
+    const peer = (data.contacts ?? []).find((c) => (c.email ?? "").toLowerCase() === email);
+    if (!peer?.personUid) {
+        throw new Error(`--attach needs ${recipient}'s person uid to place the file, and they are not in your contacts yet. Send the DM without --attach first (it becomes a connection request), or use their prs_ uid.`);
+    }
+    return peer.personUid;
+}
 function friendlyDmError(status, code, fallback) {
     if (status === 401)
         return "Not authenticated — run `hq login` and try again.";
@@ -596,7 +681,10 @@ async function fetchChannelMessages(token, channelId, query = {}) {
 async function runChannelSend(channelName, message, opts) {
     try {
         let body = (message ?? "").trim();
-        if (!body) {
+        // Validate attachments before anything touches the network; an empty body
+        // is allowed when files are attached.
+        const localFiles = validateAttachmentPaths(opts.attach ?? []);
+        if (!body && localFiles.length === 0) {
             console.error(chalk.red(`A message body is required: hq dm ${channelName} "<message>" (or hq dm --channel ${channelName} "<message>").`));
             process.exit(1);
         }
@@ -619,7 +707,7 @@ async function runChannelSend(channelName, message, opts) {
         const channels = await fetchChannels(token);
         const matches = matchChannelsByName(channels, channelName);
         if (matches.length === 0) {
-            console.error(chalk.red(`No channel named '${channelName}' — run \`hq channels\` to see your channels.`));
+            console.error(chalk.red(withChannelSuggestions(`No channel named '${channelName}' — run \`hq channels\` to see your channels.`, suggestChannels(channels, channelName))));
             process.exit(1);
         }
         if (matches.length > 1) {
@@ -677,6 +765,24 @@ async function runChannelSend(channelName, message, opts) {
             payload.rootEventId = rootEventId;
         if (audience)
             payload.audience = audience;
+        // Upload after the channel and thread resolved (so a bad name never
+        // uploads anything) and before the post (so the post never names bytes
+        // that are not there). Company channels store in the company vault;
+        // personal channels in the caller's personal vault.
+        let uploaded = [];
+        if (localFiles.length > 0) {
+            const callerUid = callerFromToken(token).personUid;
+            const scopeUid = channel.companyUid?.trim()
+                ? attachmentScopeForChannel(channel, callerUid ?? "")
+                : personalScopeForCaller(callerUid);
+            uploaded = await uploadDmAttachments({
+                token,
+                scopeUid,
+                target: { scope: "chan", channelId: channel.channelId },
+                files: localFiles,
+            });
+            payload.attachments = uploaded;
+        }
         const sendRes = await vaultApiFetch({
             token,
             path: `/v1/notify/channels/${encodeURIComponent(channel.channelId)}/messages`,
@@ -692,7 +798,12 @@ async function runChannelSend(channelName, message, opts) {
             ? ` Mentioned ${mentions.map((m) => m.displayName).join(", ")}.`
             : "";
         const threadSuffix = rootEventId ? ` Reply in thread ${rootEventId}.` : "";
-        console.log(chalk.green(`Message posted to #${channel.name ?? channelName}.${mentionSuffix}${threadSuffix}`));
+        const attachSuffix = uploaded.length > 0
+            ? ` Attached ${uploaded.length} file${uploaded.length === 1 ? "" : "s"}.`
+            : "";
+        console.log(chalk.green(`${formatChannelPostedLine(channel, channelName)}${mentionSuffix}${threadSuffix}${attachSuffix}`));
+        if (uploaded.length > 0)
+            console.log(chalk.dim(formatUploadedAttachments(uploaded)));
     }
     catch (err) {
         console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -719,14 +830,30 @@ async function runDmSend(recipient, message, opts) {
             process.exit(1);
             return;
         }
+        if (opts.attach && opts.attach.length > 0) {
+            // A group is created on the fly, so there is no conversation to place
+            // the file in before the send. Not supported in this release.
+            console.error(chalk.red("--attach is not supported for group DMs yet. Post the file in a named channel (hq dm <channel> --attach <path>) or DM each person."));
+            process.exit(1);
+            return;
+        }
         await runGroupSend(group, message);
         return;
     }
     // A bare name or #hash addresses a named DM channel.
     const channelName = parseChannelName(recipient);
     if (channelName !== null) {
-        await runChannelSend(channelName, message, opts);
-        return;
+        // A bare word (no '#') may name a person as well as a channel. Prefer the
+        // exact person and say so; '#name' or --channel always means the channel.
+        const person = recipient.trim().startsWith("#")
+            ? null
+            : matchContactByName(await fetchContacts(await ensureCognitoToken()), channelName);
+        if (!person?.personUid) {
+            await runChannelSend(channelName, message, opts);
+            return;
+        }
+        console.log(chalk.dim(`Resolved '${channelName}' to person ${person.displayName || person.email || person.personUid} (${person.personUid}). Use '#${channelName}' or --channel ${channelName} to post to a channel instead.`));
+        recipient = person.personUid;
     }
     if (opts.thread !== undefined) {
         console.error(chalk.red("--thread is only supported for channel messages (hq dm <channel> --thread <eventId|last> \"…\")."));
@@ -741,7 +868,10 @@ async function runDmSend(recipient, message, opts) {
         let details = opts.details;
         if (opts.detailsFile)
             details = readFileSync(opts.detailsFile, "utf8");
-        const reqBody = buildDmBody({
+        // Validate the local files and every option combination before any
+        // network call, so a refused send uploads nothing.
+        const localFiles = validateAttachmentPaths(opts.attach ?? []);
+        const dryBody = buildDmBody({
             recipient,
             message: message ?? "",
             prompt,
@@ -750,8 +880,31 @@ async function runDmSend(recipient, message, opts) {
             inDelay: opts.in,
             now: Date.now(),
             audience: opts.audience,
+            // Placeholder entries only prove the option set is valid; the real
+            // entries come back from the upload below.
+            attachments: localFiles.map((f) => ({ vaultPath: "", companyUid: "", name: f.name, sizeBytes: f.sizeBytes, contentType: f.contentType })),
         });
         const token = await ensureCognitoToken();
+        let uploaded = [];
+        if (localFiles.length > 0) {
+            // A 1:1 attachment is stored in the SENDER's personal vault under the
+            // sorted participant pair; the server lets either member read it.
+            const callerUid = callerFromToken(token).personUid;
+            const scopeUid = personalScopeForCaller(callerUid);
+            const peerUid = await resolveDmPeerUid(token, recipient);
+            uploaded = await uploadDmAttachments({
+                token,
+                scopeUid,
+                target: { scope: "dm", uids: [scopeUid, peerUid] },
+                files: localFiles,
+            });
+        }
+        const reqBody = {
+            ...dryBody,
+            ...(uploaded.length > 0 ? { attachments: uploaded } : {}),
+        };
+        if (uploaded.length === 0)
+            delete reqBody.attachments;
         const res = await vaultApiFetch({
             token,
             path: "/v1/notify/dm",
@@ -777,7 +930,12 @@ async function runDmSend(recipient, message, opts) {
             console.log(chalk.dim("It delivers within ~60s of that time, even if you're offline."));
         }
         else {
-            console.log(chalk.green(`DM sent to ${recipient} (eventId ${data.eventId}).`));
+            const attachSuffix = uploaded.length > 0
+                ? ` Attached ${uploaded.length} file${uploaded.length === 1 ? "" : "s"}.`
+                : "";
+            console.log(chalk.green(`DM sent to ${recipient} (eventId ${data.eventId}).${attachSuffix}`));
+            if (uploaded.length > 0)
+                console.log(chalk.dim(formatUploadedAttachments(uploaded)));
         }
     }
     catch (err) {
@@ -1460,7 +1618,7 @@ async function resolveChannel(token, target) {
     const byId = channels.find((c) => c.channelId === raw);
     if (byId)
         return byId;
-    throw new Error(`No channel named or with id '${raw}' — run \`hq channels\` to see yours.`);
+    throw new ChannelNotFoundError(`No channel named or with id '${raw}' — run \`hq channels\` to see yours.`, suggestChannels(channels, raw));
 }
 async function runDmChannel(target, opts) {
     try {
@@ -1529,6 +1687,9 @@ async function runDmChannel(target, opts) {
         }
     }
     catch (err) {
+        if (opts.json && err instanceof ChannelNotFoundError) {
+            console.log(JSON.stringify({ ok: false, error: err.baseMessage, suggestions: err.suggestions }, null, 2));
+        }
         console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
         process.exit(1);
     }
@@ -1550,6 +1711,7 @@ export function registerDmCommand(program) {
         .option("--at <iso>", "Schedule delivery at an ISO8601 time (store-and-forward; delivered within ~60s of the time; 1:1 DMs only)")
         .option("--in <duration>", "Schedule delivery after a relative delay: 30s, 10m, 2h, 1d (1:1 DMs only)")
         .option("--audience <human|agent|both>", "Tag who this message is for: human (a person must read it), agent (progress/status, hidden from humans by default), or both")
+        .option("--attach <path>", "Upload a local file and attach it to the message (repeatable, up to 5 files, 25 MB each). 1:1 DMs and named channels; the file lands in the conversation's vault scope and the recipient can open it. Not available for group DMs or scheduled sends.", (value, previous = []) => [...previous, value])
         .action(async (recipient, message, opts) => {
         await runDmSend(recipient, message, opts);
     });

package/dist/commands/feedback-show.d.ts

@@ -0,0 +1,40 @@
+import { Command } from "commander";
+export declare function normalizeFeedbackId(raw: string): string;
+export interface FeedbackAttachmentEntry {
+    /** Where the attachment came from: a CLI screenshot or an email-ticket message. */
+    source: "screenshot" | "email";
+    name: string;
+    key?: string;
+    contentType?: string;
+    bytes?: number;
+    downloadUrl?: string;
+    downloadPath?: string;
+}
+type Row = Record<string, unknown>;
+/** Collect every attachment the row exposes, in a stable order. */
+export declare function collectFeedbackAttachments(item: Row): FeedbackAttachmentEntry[];
+/** The log bundle id (`logs-<uuid>`) from the row's logBundle key, if any. */
+export declare function logBundleIdFor(item: Row): string | undefined;
+/** Strip every download link so `--json` output never carries a presigned URL. */
+export declare function redactDownloadLinks(item: Row): Row;
+/** A safe local file name: no directory parts, no leading dots, unique in `used`. */
+export declare function safeFileName(name: string, index: number, used: Set<string>): string;
+export declare function fetchFeedbackRow(id: string, token: string): Promise<Row>;
+export interface DownloadResult {
+    file?: string;
+    name: string;
+    bytes?: number;
+    error?: string;
+}
+export declare function downloadFeedbackAttachments(opts: {
+    id: string;
+    item: Row;
+    dir: string;
+    token: string;
+    includeLogs: boolean;
+    fetchImpl?: typeof fetch;
+}): Promise<DownloadResult[]>;
+export declare function formatFeedbackRow(item: Row): string;
+export declare function registerFeedbackShowCommand(feedbackCmd: Command): void;
+export {};
+//# sourceMappingURL=feedback-show.d.ts.map

package/dist/commands/feedback-show.js

@@ -0,0 +1,261 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+/**
+ * `hq feedback show <id>` — operator-only fetch of one feedback row and its
+ * attachments (CLI screenshots, email-ticket attachments, the log bundle).
+ *
+ * Access is enforced by hq-pro: `GET /v1/feedback/{id}` refuses non-operators
+ * with 403, and only staff callers receive download links. This command never
+ * prints a download URL or a token; with `--download` it writes the files to a
+ * local directory instead.
+ */
+const FEEDBACK_ID_RE = /^(?:feedback_)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+const LOG_BUNDLE_ID_RE = /^logs-[0-9a-f-]{36}$/i;
+export function normalizeFeedbackId(raw) {
+    const match = FEEDBACK_ID_RE.exec(raw.trim());
+    if (!match) {
+        throw new Error(`Invalid feedback id '${raw}'. Use feedback_<uuid> or the bare uuid.`);
+    }
+    return `feedback_${match[1].toLowerCase()}`;
+}
+function str(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function baseName(key) {
+    const parts = key.split("/").filter(Boolean);
+    return parts[parts.length - 1] ?? key;
+}
+/** Collect every attachment the row exposes, in a stable order. */
+export function collectFeedbackAttachments(item) {
+    const out = [];
+    const linked = Array.isArray(item.screenshotDownloads) ? item.screenshotDownloads : [];
+    const byKey = new Map();
+    for (const entry of linked) {
+        if (entry && typeof entry === "object" && typeof entry.key === "string") {
+            byKey.set(entry.key, entry);
+        }
+    }
+    const screenshots = Array.isArray(item.screenshots) ? item.screenshots : [];
+    for (const key of screenshots) {
+        if (typeof key !== "string")
+            continue;
+        const link = byKey.get(key);
+        out.push({
+            source: "screenshot",
+            name: baseName(key),
+            key,
+            ...(link && str(link.downloadUrl) ? { downloadUrl: link.downloadUrl } : {}),
+        });
+    }
+    const messages = Array.isArray(item.messages) ? item.messages : [];
+    for (const message of messages) {
+        if (!message || typeof message !== "object")
+            continue;
+        const attachments = message.attachments;
+        if (!Array.isArray(attachments))
+            continue;
+        for (const raw of attachments) {
+            if (!raw || typeof raw !== "object")
+                continue;
+            const a = raw;
+            const key = str(a.key);
+            out.push({
+                source: "email",
+                name: str(a.filename) ?? (key ? baseName(key) : "attachment"),
+                ...(key ? { key } : {}),
+                ...(str(a.contentType) ? { contentType: a.contentType } : {}),
+                ...(typeof a.bytes === "number" ? { bytes: a.bytes } : {}),
+                ...(str(a.downloadUrl) ? { downloadUrl: a.downloadUrl } : {}),
+                ...(str(a.downloadPath) ? { downloadPath: a.downloadPath } : {}),
+            });
+        }
+    }
+    return out;
+}
+/** The log bundle id (`logs-<uuid>`) from the row's logBundle key, if any. */
+export function logBundleIdFor(item) {
+    const bundle = item.logBundle;
+    if (!bundle || typeof bundle !== "object")
+        return undefined;
+    const key = str(bundle.key);
+    if (!key)
+        return undefined;
+    const id = baseName(key).split(".")[0] ?? "";
+    return LOG_BUNDLE_ID_RE.test(id) ? id : undefined;
+}
+/** Strip every download link so `--json` output never carries a presigned URL. */
+export function redactDownloadLinks(item) {
+    return JSON.parse(JSON.stringify(item, (k, v) => (k === "downloadUrl" || k === "url" ? undefined : v)));
+}
+/** A safe local file name: no directory parts, no leading dots, unique in `used`. */
+export function safeFileName(name, index, used) {
+    let base = path.basename(name).replace(/[^A-Za-z0-9._-]/g, "_").replace(/^\.+/, "");
+    if (!base)
+        base = `attachment-${index}`;
+    let candidate = `${index}-${base}`;
+    let n = 1;
+    while (used.has(candidate))
+        candidate = `${index}-${n++}-${base}`;
+    used.add(candidate);
+    return candidate;
+}
+async function errorText(res) {
+    const data = (await res.json().catch(() => ({})));
+    return typeof data?.error === "string" ? data.error : res.statusText;
+}
+export async function fetchFeedbackRow(id, token) {
+    const res = await vaultApiFetch({ path: `/v1/feedback/${id}`, token });
+    if (res.status === 401 || res.status === 403) {
+        throw new Error("hq feedback show is for HQ operators only. Your login is not allowed to read feedback rows.");
+    }
+    if (res.status === 404)
+        throw new Error(`Feedback '${id}' not found.`);
+    if (!res.ok)
+        throw new Error(`Failed to fetch feedback: ${await errorText(res)}`);
+    const data = (await res.json());
+    if (!data.item || typeof data.item !== "object")
+        throw new Error("Malformed feedback response.");
+    return data.item;
+}
+async function downloadUrlTo(url, file, fetchImpl) {
+    const res = await fetchImpl(url);
+    if (!res.ok)
+        throw new Error(`download failed (HTTP ${res.status})`);
+    const bytes = Buffer.from(await res.arrayBuffer());
+    fs.writeFileSync(file, bytes);
+    return bytes.byteLength;
+}
+export async function downloadFeedbackAttachments(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    fs.mkdirSync(opts.dir, { recursive: true });
+    const used = new Set();
+    const results = [];
+    const attachments = collectFeedbackAttachments(opts.item);
+    for (const [index, a] of attachments.entries()) {
+        const file = path.join(opts.dir, safeFileName(a.name, index, used));
+        try {
+            if (a.downloadUrl) {
+                results.push({ file, name: a.name, bytes: await downloadUrlTo(a.downloadUrl, file, fetchImpl) });
+            }
+            else if (a.downloadPath && a.downloadPath.startsWith(`/v1/feedback/${opts.id}?`)) {
+                const [p, q] = a.downloadPath.split("?");
+                const query = Object.fromEntries(new URLSearchParams(q ?? ""));
+                const res = await vaultApiFetch({ path: p, query, token: opts.token });
+                if (!res.ok)
+                    throw new Error(await errorText(res));
+                const data = (await res.json());
+                if (typeof data.contentBase64 !== "string")
+                    throw new Error("no content returned");
+                const bytes = Buffer.from(data.contentBase64, "base64");
+                fs.writeFileSync(file, bytes);
+                results.push({ file, name: a.name, bytes: bytes.byteLength });
+            }
+            else {
+                results.push({ name: a.name, error: "no download link (operator access or the attachment-download flag is off)" });
+            }
+        }
+        catch (err) {
+            results.push({ name: a.name, error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    const bundleId = opts.includeLogs ? logBundleIdFor(opts.item) : undefined;
+    if (bundleId) {
+        const name = baseName(opts.item.logBundle.key);
+        try {
+            const res = await vaultApiFetch({ path: `/v1/feedback/${opts.id}/logs/${bundleId}/view`, token: opts.token });
+            if (!res.ok)
+                throw new Error(await errorText(res));
+            const data = (await res.json());
+            if (typeof data.url !== "string")
+                throw new Error("no link returned");
+            const file = path.join(opts.dir, safeFileName(name, attachments.length, used));
+            results.push({ file, name, bytes: await downloadUrlTo(data.url, file, fetchImpl) });
+        }
+        catch (err) {
+            results.push({ name, error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    return results;
+}
+export function formatFeedbackRow(item) {
+    const lines = [];
+    const field = (label, value) => {
+        if (value !== undefined && value !== null && value !== "")
+            lines.push(`${label}: ${String(value)}`);
+    };
+    field("ID", item.id);
+    field("Title", item.title);
+    field("Type", item.type);
+    field("Status", item.status);
+    field("Company", item.company ?? item.companySlug);
+    field("Reporter", item.email);
+    field("Submitted", item.submittedAt);
+    field("Linear", item.linearIssueIdentifier);
+    const attachments = collectFeedbackAttachments(item);
+    lines.push(`Attachments: ${attachments.length}`);
+    for (const a of attachments) {
+        const meta = [a.source, a.contentType, typeof a.bytes === "number" ? `${a.bytes} bytes` : undefined]
+            .filter(Boolean)
+            .join(", ");
+        const link = a.downloadUrl || a.downloadPath ? "downloadable" : "no link";
+        lines.push(`  - ${a.name} (${meta}; ${link})`);
+    }
+    const bundle = item.logBundle;
+    if (bundle && typeof bundle === "object") {
+        const size = typeof bundle.sizeBytes === "number" ? `, ${bundle.sizeBytes} bytes` : "";
+        lines.push(`Log bundle: ${baseName(String(bundle.key ?? ""))}${size} (use --download <dir> --logs)`);
+    }
+    if (typeof item.body === "string")
+        lines.push("", item.body);
+    return lines.join("\n");
+}
+export function registerFeedbackShowCommand(feedbackCmd) {
+    feedbackCmd
+        .command("show <id>")
+        .description("Operators only: show one feedback row and fetch its attachments")
+        .option("--download <dir>", "Save screenshots and attachments into this directory")
+        .option("--logs", "With --download, also save the row's log bundle")
+        .option("--json", "Print the row as JSON (download links removed)")
+        .action(async (rawId, opts) => {
+        try {
+            const id = normalizeFeedbackId(rawId);
+            const token = await ensureCognitoToken({ interactive: false });
+            const item = await fetchFeedbackRow(id, token);
+            if (opts.json) {
+                console.log(JSON.stringify(redactDownloadLinks(item), null, 2));
+            }
+            else {
+                console.log(formatFeedbackRow(item));
+            }
+            if (opts.download) {
+                const results = await downloadFeedbackAttachments({
+                    id,
+                    item,
+                    dir: path.resolve(opts.download),
+                    token,
+                    includeLogs: opts.logs === true,
+                });
+                let failed = 0;
+                for (const r of results) {
+                    if (r.error) {
+                        failed++;
+                        console.error(chalk.yellow(`Not saved: ${r.name}: ${r.error}`));
+                    }
+                    else {
+                        console.error(`Saved ${r.file} (${r.bytes} bytes)`);
+                    }
+                }
+                if (failed > 0)
+                    process.exitCode = 1;
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=feedback-show.js.map

package/dist/commands/feedback.d.ts

@@ -20,6 +20,8 @@ export declare function validateFeedbackContent(title: string, body: string): vo
 export declare const REQUEST_MAX_BYTES: number;
 export interface FeedbackResult {
     id: string;
+    /** Public tracking page (status.hqforwork.com/t/<token>); absent on older servers. */
+    publicUrl?: string;
 }
 export interface FeedbackSubmitOptions {
     type: "bug" | "feature";
@@ -70,5 +72,24 @@ export declare function attachDebugLogs(requestBody: Record<string, unknown>, di
     envEnabled?: typeof feedbackLogsEnabled;
 }): void;
 export declare function submitFeedback(opts: FeedbackSubmitOptions): Promise<FeedbackResult>;
+/** Customer-visible states accepted by `hq feedback update --state`. */
+export declare const PUBLIC_TICKET_STATES: readonly ["triaged", "in-progress", "shipped", "verified", "resolved"];
+export type PublicTicketState = (typeof PUBLIC_TICKET_STATES)[number];
+export declare function assertFeedbackId(id: string): void;
+/** Resolve (and lazily mint) the public tracking link for a ticket. */
+export declare function fetchFeedbackLink(opts: {
+    id: string;
+    token: string;
+}): Promise<string>;
+/** Post a customer-visible update; the server also mirrors it into #hq-feedback. */
+export declare function postFeedbackUpdate(opts: {
+    id: string;
+    token: string;
+    state: PublicTicketState;
+    note: string;
+}): Promise<{
+    publicUrl: string | null;
+    slack: string | null;
+}>;
 export declare function registerFeedbackCommand(program: Command): void;
 //# sourceMappingURL=feedback.d.ts.map