@indigoai-us/hq-cli 5.345.188 → 5.345.190

package/dist/commands/dm.js

@@ -1,5 +1,6 @@
 import chalk from "chalk";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { join as pathJoin } from "node:path";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveCallerPersonUid, resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
@@ -10,7 +11,7 @@ import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN, PERSON_AGENT_AUDIENCE_MESSAGE, PE
 import { callerIsMachinePrincipal } from "../lib/caller-principal.js";
 export { defaultAudienceFor, recipientKindOf };
 import { dmForwardCliEnabled } from "./dm-forward-flag.js";
-import { attachmentScopeForChannel, formatUploadedAttachments, personalScopeForCaller, uploadDmAttachments, validateAttachmentPaths, } from "./dm-attach.js";
+import { attachmentReadScopes, attachmentScopeForChannel, downloadChatAttachment, findMessageAttachments, parseChatAttachmentKey, sanitizeAttachmentName, formatUploadedAttachments, personalScopeForCaller, uploadDmAttachments, validateAttachmentPaths, } from "./dm-attach.js";
 import { ChannelNotFoundError, suggestChannels, withChannelSuggestions, } from "./channel-suggest.js";
 /**
  * Classify a recipient arg as an email or a person/agent uid. Mirrors the
@@ -1679,6 +1680,107 @@ async function runDmInbox(opts) {
         process.exit(1);
     }
 }
+/**
+ * Where to write each downloaded attachment. One file and an `--out` that is
+ * not an existing directory: write exactly there. Otherwise `--out` (default
+ * cwd) is a directory and each file keeps its sanitized name. Pure apart from
+ * the injected `isDir`.
+ */
+export function attachmentOutputPaths(refs, out, isDir) {
+    const nameOf = (r) => sanitizeAttachmentName(r.name?.trim() || r.vaultPath.split("/").pop() || "file");
+    if (refs.length === 1 && out && !isDir(out))
+        return [out];
+    const dir = out ?? ".";
+    // Two files with the same sanitized name get distinct targets: name-1.ext, name-2.ext.
+    const used = new Set();
+    return refs.map((r) => {
+        const base = nameOf(r);
+        let name = base;
+        for (let n = 1; used.has(name); n++) {
+            const dot = base.lastIndexOf(".");
+            name = dot > 0 ? `${base.slice(0, dot)}-${n}${base.slice(dot)}` : `${base}-${n}`;
+        }
+        used.add(name);
+        return pathJoin(dir, name);
+    });
+}
+async function runDmAttachment(ref, opts) {
+    try {
+        const token = await ensureCognitoToken();
+        const callerUid = agentCallerUid(token) ?? (await callerUidForAttach(token));
+        let refs;
+        if (parseChatAttachmentKey(ref)) {
+            refs = [{ vaultPath: ref.trim() }];
+        }
+        else {
+            if (agentCallerUid(token)) {
+                throw new Error("Agents cannot look up an eventId in the person inbox. Pass the attachment's vault path instead.");
+            }
+            const res = await vaultApiFetch({
+                token,
+                path: "/v1/notify/inbox",
+                query: { limit: opts.limit ?? "100" },
+            });
+            if (!res.ok) {
+                const err = (await res.json().catch(() => ({})));
+                throw new Error(friendlyDmError(res.status, err.code, err.error ?? err.message ?? res.statusText));
+            }
+            const data = (await res.json());
+            const found = findMessageAttachments(data.events ?? [], ref);
+            if (found === null) {
+                throw new Error(`No message ${ref} in your last ${opts.limit ?? "100"} inbox messages. Raise --limit, or pass the attachment's vault path.`);
+            }
+            if (found.length === 0)
+                throw new Error(`Message ${ref} has no attachments.`);
+            refs = found;
+        }
+        const targets = attachmentOutputPaths(refs, opts.out, (p) => {
+            try {
+                return statSync(p).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        });
+        // Check every destination before writing anything, so a clash never leaves
+        // a partial download behind.
+        if (!opts.force) {
+            const clash = targets.find((dest) => existsSync(dest));
+            if (clash) {
+                throw new Error(`${clash} already exists. Pass --force to overwrite, or --out to choose another path.`);
+            }
+        }
+        const scopes = refs.map((r) => attachmentReadScopes({
+            vaultPath: r.vaultPath,
+            companyUid: opts.company ?? r.companyUid,
+            callerUid,
+            senderUid: r.senderUid,
+        }));
+        for (let i = 0; i < refs.length; i++) {
+            const r = refs[i];
+            const dest = targets[i];
+            let bytes;
+            let lastErr;
+            for (const scopeUid of scopes[i]) {
+                try {
+                    bytes = await downloadChatAttachment({ token, scopeUid, vaultPath: r.vaultPath });
+                    break;
+                }
+                catch (e) {
+                    lastErr = e;
+                }
+            }
+            if (!bytes)
+                throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+            writeFileSync(dest, bytes);
+            console.log(chalk.green(`Saved ${dest}`) + chalk.dim(` (${bytes.length} bytes)`));
+        }
+    }
+    catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
 async function runDmThread(identifier, opts) {
     try {
         const query = buildThreadQuery(identifier);
@@ -1879,6 +1981,16 @@ export function registerDmCommand(program) {
         .action(async (opts) => {
         await runDmInbox(opts);
     });
+    dm
+        .command("attachment <ref>")
+        .description("Download a file attached to a DM. REF is the message eventId from `hq dm inbox` (downloads every file on it) or the attachment's vault path (chat/attachments/...). The file is read from the sender's vault; only the two people in the conversation can open a DM attachment.")
+        .option("--out <path>", "Where to write: a file path for one attachment, else a directory (default: current directory)")
+        .option("--company <uid>", "Vault scope the file lives in (the companyUid shown on the message). Derived from the DM pair when omitted")
+        .option("--force", "Overwrite an existing file")
+        .option("--limit <n>", "How many recent inbox messages to search for the eventId", "100")
+        .action(async (ref, opts) => {
+        await runDmAttachment(ref, opts);
+    });
     dm
         .command("thread <person>")
         .alias("read")

package/dist/commands/files.d.ts

@@ -242,6 +242,24 @@ export declare function runFilesRestore(params: {
 }, deps?: {
     confirm?: ConfirmFn;
 }): Promise<FilesRestoreResponse | undefined>;
+export interface FilesPurgeResponse {
+    key: string;
+    purgedVersionId: string;
+}
+/**
+ * feedback_fc711fc3: permanently delete one noncurrent version. The server
+ * (hq-pro POST /v1/files/restore, action "purge") enforces owner-only access,
+ * refuses the current version and delete markers, and audits before deleting.
+ */
+export declare function runFilesPurge(params: {
+    key: string;
+    versionId: string;
+    yes: boolean;
+    personal: boolean;
+    companySlug: string | undefined;
+}, deps?: {
+    confirm?: ConfirmFn;
+}): Promise<FilesPurgeResponse | undefined>;
 export declare function runFilesTrash(params: {
     prefix: string;
     cursor?: string;

package/dist/commands/files.js

@@ -731,6 +731,30 @@ export function registerFilesCommand(program) {
             process.exit(1);
         }
     });
+    files
+        .command("purge <path>")
+        .description("Permanently delete ONE retained (noncurrent) version of an exact vault key, for example a version that held data which must not live in HQ. Owner only; audited; cannot be undone. Delete the file first if the version is current. Use --personal for your personal vault.")
+        .option("--personal", "Target your own personal vault instead of a company vault (mutually exclusive with --company)")
+        .requiredOption("--version-id <id>", "Exact version ID to purge (see `hq files versions`)")
+        .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
+        .action(async (path, opts) => {
+        try {
+            const companySlug = files.opts().company;
+            const personal = opts.personal === true;
+            assertRecoveryScope(personal, companySlug);
+            await runFilesPurge({
+                key: path,
+                versionId: opts.versionId,
+                yes: opts.yes === true,
+                personal,
+                companySlug,
+            });
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
     files
         .command("trash")
         .description("List deleted vault keys retained as tombstones. Use --personal for your personal vault.")
@@ -1767,6 +1791,55 @@ export async function runFilesRestore(params, deps = {}) {
     console.log(chalk.dim("New version: " + data.newVersionId));
     return data;
 }
+/**
+ * feedback_fc711fc3: permanently delete one noncurrent version. The server
+ * (hq-pro POST /v1/files/restore, action "purge") enforces owner-only access,
+ * refuses the current version and delete markers, and audits before deleting.
+ */
+export async function runFilesPurge(params, deps = {}) {
+    assertExactRecoveryKey(params.key);
+    if (typeof params.versionId !== "string" || params.versionId.trim() === "") {
+        throw new Error("--version-id is required and must not be empty.");
+    }
+    const confirm = deps.confirm ?? realConfirm;
+    if (!params.yes) {
+        const ok = await confirm("Permanently delete version '" + params.versionId + "' of '" + params.key + "'" +
+            (params.personal ? " in your personal vault" : "") +
+            "? This cannot be undone.");
+        if (!ok) {
+            console.log(chalk.dim("Aborted — nothing was purged."));
+            return undefined;
+        }
+    }
+    const scope = await resolveRecoveryScope(params);
+    const body = scope.personal
+        ? { personal: true, key: params.key }
+        : { company: scope.companyUid, key: params.key };
+    body.action = "purge";
+    body.purgeVersionId = params.versionId;
+    // Tripwire: a server without purge support rejects `versionId: null` with
+    // 400 instead of ignoring `action` and restoring (re-publishing) the version.
+    body.versionId = null;
+    const res = await vaultApiFetch({
+        token: scope.token,
+        path: "/v1/files/restore",
+        method: "POST",
+        body,
+    });
+    if (!res.ok) {
+        const errBody = (await res.json().catch(() => ({})));
+        const err = new FilesRecoveryHttpError(res.status, errBody.message ?? errBody.error ?? res.statusText, errBody.code);
+        throw new Error(formatFilesRecoveryError(err, params.key));
+    }
+    const data = (await res.json());
+    // Belt and braces with the tripwire above: only a server that echoes the
+    // purged version id has purged it.
+    if (data.purgedVersionId !== params.versionId) {
+        throw new Error("The server did not confirm the purge (it may not support purge yet). Check `hq files versions` before retrying.");
+    }
+    console.log(chalk.green("Purged version '" + data.purgedVersionId + "' of '" + params.key + "'."));
+    return { key: data.key ?? params.key, purgedVersionId: data.purgedVersionId };
+}
 export async function runFilesTrash(params) {
     if (params.prefix.includes("*")) {
         throw new Error("Trash prefix must be literal; wildcard expansion is not supported.");

package/dist/commands/sources.js

@@ -43,6 +43,7 @@ import { createPersonVaultReader } from "../lib/hot-channels/person-vault-reader
 import { S3Client } from "@aws-sdk/client-s3";
 import { resolveCanonicalPersonUid } from "./cloud.js";
 import { botsRoot as defaultBotsRoot } from "../lib/bot/paths.js";
+import { ensureHotSignalSyncJob } from "../lib/bot/jobs/hot-signal-sync.js";
 import { findHotSignalSyncJobs, lastRunsPerAdapter, parseDailyAt, renderScheduleReport, rescheduleDaily, toJobView, } from "../lib/hot-channels/schedule.js";
 import { listActiveMembers } from "./members.js";
 import { runOnDemandSync, } from "../lib/hot-channels/run.js";
@@ -619,6 +620,20 @@ export async function runSchedule(options, overrides = {}) {
         parseDailyAt(options.at);
     let found = findHotSignalSyncJobs(overrides.botsRoot ?? defaultBotsRoot(), company);
     if (options.at !== undefined) {
+        if (found.length === 0) {
+            // Setting a time turns the daily sync on: register it on the personal setup bot.
+            const root = overrides.botsRoot ?? defaultBotsRoot();
+            const setupDir = path.join(root, "setup");
+            if (fs.existsSync(setupDir)) {
+                const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+                const otherBotDirs = fs
+                    .readdirSync(root, { withFileTypes: true })
+                    .filter((d) => d.isDirectory())
+                    .map((d) => path.join(root, d.name));
+                ensureHotSignalSyncJob(setupDir, { company, timezone, otherBotDirs }, now);
+                found = findHotSignalSyncJobs(root, company);
+            }
+        }
         if (found.length === 0)
             throw new NoHotSignalSyncJobError(company);
         found = rescheduleDaily(found, options.at, now);