@indigoai-us/hq-cli 5.35.0 → 5.35.2

package/src/commands/pack-install.ts

@@ -402,9 +402,22 @@ export function defaultMarketplaceDeps(): MarketplaceDeps {
   return {
     resolveListing: async (slug, version) => {
       // Search by slug (public). The API returns approved listings only.
+      //
+      // BUGFIX: the browse handler historically IGNORED `?slug=` and only
+      // honored `?q=` (fuzzy), so `?slug=tdd` returned ALL approved listings
+      // newest-first — and blindly taking `listings[0]` then installed the
+      // newest pack, not the requested slug (e.g. `marketplace:tdd` installed
+      // hq-pack-review). We now (a) query with BOTH `slug` (exact, server-side
+      // filter being added in parallel) AND `q` (fuzzy fallback) so the right
+      // results come back whichever param the server honors, and (b) NEVER take
+      // `listings[0]` — we exact-match `l.slug === slug` among the results and
+      // throw a clear error if none matches, rather than installing the wrong
+      // pack.
+      const query: Record<string, string> = { slug, q: slug };
+      if (version) query.version = version;
       const res = await vaultApiFetchPublic({
         path: '/v1/listings',
-        query: version ? { slug, version } : { slug },
+        query,
       });
       if (!res.ok) {
         throw new Error(
@@ -415,12 +428,22 @@ export function defaultMarketplaceDeps(): MarketplaceDeps {
         listings?: RawListingSummary[];
       };
       const listings = body.listings ?? [];
-      const match = version
-        ? listings.find((l) => (l.version ?? l.latestVersion) === version)
-        : listings[0];
+      // Only consider listings whose slug EXACTLY matches the request — the
+      // fuzzy `q` search (and a slug-ignoring browse handler) can return
+      // unrelated packs, so an exact-slug filter is the safety floor.
+      const exact = listings.filter((l) => l.slug === slug);
+      let match: RawListingSummary | undefined;
+      if (version) {
+        // Pinned `marketplace:<slug>@<version>` → require an exact version too.
+        match = exact.find((l) => (l.version ?? l.latestVersion) === version);
+      } else {
+        // No pin → newest exact-slug match. The feed is newest-first, so the
+        // first exact-slug entry is the newest version of that slug.
+        match = exact[0];
+      }
       if (!match) {
         throw new Error(
-          `No approved marketplace listing found for "${slug}"${version ? `@${version}` : ''}.`,
+          `No marketplace listing found for slug "${slug}"${version ? `@${version}` : ''}.`,
         );
       }
       const id = match.listingId ?? match.id;
@@ -998,7 +1021,12 @@ export function validateManifest(
   if (!range || !semverValidRange(range)) {
     throw new Error(`requires.hqCore must be a valid semver range (got "${range}")`);
   }
-  if (hqVersion && !semverSatisfies(hqVersion, range)) {
+  // `includePrerelease` so a prerelease host version (e.g. `15.0.9-beta.1`)
+  // satisfies a plain range like `>=14.2.0`. By default node-semver excludes
+  // prereleases from range matching, which would wrongly reject every dogfooding
+  // beta/rc HQ build from installing packs. A genuinely-too-old host (e.g.
+  // `13.0.0`) still fails the range.
+  if (hqVersion && !semverSatisfies(hqVersion, range, { includePrerelease: true })) {
     throw new Error(
       `Host hqCore ${hqVersion} does not satisfy pack requirement ${range}`
     );

package/src/commands/publish.test.ts

@@ -166,6 +166,11 @@ describe('buildListingNotice', () => {
   it('maps 401/403 to an auth error', () => {
     expect(() => buildListingNotice(401, {}, 'hq-pack-demo', '1.0.0')).toThrow(/Not authorized|login/i);
   });
+  it('maps a 403 NOT_VERIFIED_CREATOR to the apply guidance', () => {
+    expect(() =>
+      buildListingNotice(403, { code: 'NOT_VERIFIED_CREATOR' }, 'hq-pack-demo', '1.0.0'),
+    ).toThrow(/hq creators apply/i);
+  });
   it('surfaces a generic server error body', () => {
     expect(() => buildListingNotice(500, { error: 'boom' }, 'hq-pack-demo', '1.0.0')).toThrow(/boom/);
   });

package/src/commands/publish.ts

@@ -315,6 +315,14 @@ export function buildListingNotice(
     );
   }
   if (status === 401 || status === 403) {
+    const code = typeof body.code === 'string' ? body.code : '';
+    if (code === 'NOT_VERIFIED_CREATOR') {
+      throw new Error(
+        'Only verified creators can publish to the marketplace. ' +
+          'Run `hq creators apply --reason "..."` to request verified-creator access; ' +
+          'an Indigo admin will review it.',
+      );
+    }
     throw new Error('Not authorized to publish — run `hq login` and ensure your creator account is verified.');
   }
   if (status < 200 || status >= 300) {

package/src/index.ts

@@ -25,6 +25,7 @@ import { registerPackageUpdateCommand } from "./commands/pkg-update.js";
 import { registerPackageListCommand } from "./commands/pkg-list.js";
 import { registerPacksCommand } from "./commands/packs.js";
 import { registerPublishCommand } from "./commands/publish.js";
+import { registerCreatorsCommand } from "./commands/creators.js";
 import { registerTeamSyncCommand } from "./commands/team-sync.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
@@ -108,6 +109,8 @@ registerPackageRemoveCommand(program);
 // "hq publish <skill-or-worker-path>" packages and submits a pack to the
 // marketplace via POST /v1/listings.
 registerPublishCommand(program);
+// `hq creators apply` — request verified-creator access (required to publish).
+registerCreatorsCommand(program);
 
 // Cloud sync subcommand group
 const syncCmd = program

package/src/utils/cognito-session.test.ts

@@ -50,10 +50,10 @@ describe("resolveDefaultHqRoot", () => {
     // companies/ already exists (we mkdir'd nested inside it)
 
     process.chdir(nested);
-    expect(resolveDefaultHqRoot()).toBe(hqDir);
+    expect(resolveDefaultHqRoot()).toBe(realpathSync(hqDir));
 
     process.chdir(hqDir);
-    expect(resolveDefaultHqRoot()).toBe(hqDir);
+    expect(resolveDefaultHqRoot()).toBe(realpathSync(hqDir));
   });
 
   it("priority 2: SKIPS a nested core/core.yaml without a sibling companies/ dir (Codex P2 on hq#146)", () => {
@@ -72,7 +72,7 @@ describe("resolveDefaultHqRoot", () => {
     process.chdir(cwdInsideCore);
     // Should walk PAST the inner core/core.yaml (no companies/ sibling) and
     // resolve to the real hqDir.
-    expect(resolveDefaultHqRoot()).toBe(hqDir);
+    expect(resolveDefaultHqRoot()).toBe(realpathSync(hqDir));
   });
 
   it("priority 3: falls back when neither $HQ_ROOT nor an HQ-root marker pair are found", () => {

package/src/utils/login-provider.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("./cognito-session.js", () => ({
+  DEFAULT_COGNITO: {
+    region: "us-east-1",
+    userPoolDomain: "vault-indigo-hq-prod",
+    clientId: "client-123",
+    port: 8765,
+    identityProvider: "Google",
+  },
+}));
+
+import {
+  cognitoConfigForLoginProvider,
+  parseLoginProvider,
+} from "./login-provider.js";
+
+describe("login provider helpers", () => {
+  it("preserves the default Cognito config when no provider is supplied", () => {
+    expect(cognitoConfigForLoginProvider(undefined).identityProvider).toBe("Google");
+  });
+
+  it("maps Microsoft to the Cognito MicrosoftPersonal IdP", () => {
+    expect(cognitoConfigForLoginProvider("microsoft").identityProvider).toBe(
+      "MicrosoftPersonal",
+    );
+  });
+
+  it("maps picker to no forced IdP", () => {
+    expect(cognitoConfigForLoginProvider("picker").identityProvider).toBeUndefined();
+  });
+
+  it("accepts provider values case-insensitively", () => {
+    expect(parseLoginProvider("Microsoft")).toBe("microsoft");
+  });
+
+  it("rejects unknown providers", () => {
+    expect(() => parseLoginProvider("github")).toThrow(
+      "Provider must be one of: google, microsoft, picker",
+    );
+  });
+});

package/src/utils/login-provider.ts

@@ -0,0 +1,30 @@
+import type { CognitoAuthConfig } from "@indigoai-us/hq-cloud";
+import { DEFAULT_COGNITO } from "./cognito-session.js";
+
+const PROVIDER_TO_COGNITO_IDP = {
+  google: "Google",
+  microsoft: "MicrosoftPersonal",
+  picker: undefined,
+} as const;
+
+export type LoginProvider = keyof typeof PROVIDER_TO_COGNITO_IDP;
+
+export function parseLoginProvider(value: string | undefined): LoginProvider | undefined {
+  if (value === undefined) return undefined;
+  const normalized = value.trim().toLowerCase();
+  if (normalized in PROVIDER_TO_COGNITO_IDP) {
+    return normalized as LoginProvider;
+  }
+  throw new Error("Provider must be one of: google, microsoft, picker");
+}
+
+export function cognitoConfigForLoginProvider(
+  value: string | undefined,
+): CognitoAuthConfig {
+  const provider = parseLoginProvider(value);
+  if (!provider) return DEFAULT_COGNITO;
+  return {
+    ...DEFAULT_COGNITO,
+    identityProvider: PROVIDER_TO_COGNITO_IDP[provider],
+  };
+}