@indigoai-us/hq-cli 5.47.15 → 5.47.17

package/src/commands/people.ts

@@ -0,0 +1,240 @@
+/**
+ * `hq people` — read a company's people (membership) records from the local HQ
+ * tree and search/resolve over them.
+ *
+ *   hq people list      [--company <slug>] [--json]
+ *   hq people search <keyword> [--company <slug>] [--json]
+ *   hq people resolve <name>   [--company <slug>] [--json]
+ *
+ * Source of truth is `companies/<company>/people/<person>/meta.yaml`. Every
+ * subcommand operates on exactly ONE company (the active company, or the one
+ * named by `--company`); nothing reads across company boundaries.
+ */
+
+import * as fs from "fs";
+import { Command, Option } from "commander";
+import chalk from "chalk";
+import * as yaml from "js-yaml";
+import { findHqRoot } from "../utils/manifest.js";
+import { manifestPath, type ManifestDoc } from "./cloud-provision.js";
+import {
+  assertSafeCompanySlug,
+  listCompanyPeople,
+  searchPeople,
+  resolveNameToEmail,
+  companyPeopleDir,
+  type PersonRecord,
+} from "../utils/people.js";
+
+interface PeopleScopeOpts {
+  company?: string;
+  hqRoot?: string;
+}
+
+/** Companies that still exist (anything not explicitly `status: archived`). */
+function activeCompanySlugs(manifest: ManifestDoc): string[] {
+  const companies = manifest.companies ?? {};
+  return Object.entries(companies)
+    .filter(([, entry]) => (entry?.status ?? "active") !== "archived")
+    .map(([slug]) => slug)
+    .sort();
+}
+
+/**
+ * Resolve the single company to operate on. Explicit `--company` always wins
+ * (after a path-safety check). Otherwise the active company is inferred from
+ * `companies/manifest.yaml`: if exactly one company exists it's used; if several
+ * do, the caller must disambiguate with `--company`.
+ */
+export function resolveCompanySlug(
+  hqRoot: string,
+  explicit: string | undefined,
+): string {
+  if (explicit) {
+    assertSafeCompanySlug(explicit);
+    return explicit;
+  }
+  const mPath = manifestPath(hqRoot);
+  if (!fs.existsSync(mPath)) {
+    throw new Error(
+      "Could not determine the active company — companies/manifest.yaml not found. " +
+        "Re-run with --company <slug>.",
+    );
+  }
+  let manifest: ManifestDoc;
+  try {
+    manifest = yaml.load(fs.readFileSync(mPath, "utf-8")) as ManifestDoc;
+  } catch (err) {
+    throw new Error(
+      `companies/manifest.yaml is malformed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+  const slugs = activeCompanySlugs(manifest ?? {});
+  if (slugs.length === 1) return slugs[0];
+  if (slugs.length === 0) {
+    throw new Error(
+      "No companies found in companies/manifest.yaml — re-run with --company <slug>.",
+    );
+  }
+  throw new Error(
+    "Multiple companies found — re-run with --company <slug> to pick one:\n" +
+      slugs.map((s) => `  --company ${s}`).join("\n"),
+  );
+}
+
+/** Resolve the HQ root: explicit override (tests) → cwd walk-up. */
+function resolveHqRoot(opts: PeopleScopeOpts): string {
+  return opts.hqRoot ?? findHqRoot();
+}
+
+function printPeopleTable(people: PersonRecord[]): void {
+  const nameW = Math.max(4, ...people.map((p) => p.name.length));
+  const emailW = Math.max(5, ...people.map((p) => (p.email ?? "—").length));
+  const roleW = Math.max(4, ...people.map((p) => (p.role ?? "—").length));
+  console.log(
+    chalk.bold(
+      [
+        "NAME".padEnd(nameW),
+        "EMAIL".padEnd(emailW),
+        "ROLE".padEnd(roleW),
+        "TYPE",
+      ].join("  "),
+    ),
+  );
+  for (const p of people) {
+    console.log(
+      [
+        p.name.padEnd(nameW),
+        (p.email ?? "—").padEnd(emailW),
+        (p.role ?? "—").padEnd(roleW),
+        p.type ?? "—",
+      ].join("  "),
+    );
+  }
+}
+
+function fail(message: string): never {
+  console.error(chalk.red(message));
+  process.exit(1);
+}
+
+export function registerPeopleCommand(program: Command): void {
+  const people = program
+    .command("people")
+    .description(
+      "List, search, and resolve a company's people (from companies/<co>/people)",
+    )
+    .option(
+      "--company <slug>",
+      "Company slug to scope to (defaults to the active company)",
+    )
+    // Hidden escape hatch for tests / non-standard layouts — point the reader at
+    // an explicit HQ tree root instead of walking up from cwd.
+    .addOption(
+      new Option(
+        "--hq-root <path>",
+        "Override the HQ tree root (advanced)",
+      ).hideHelp(),
+    );
+
+  people
+    .command("list")
+    .description("List all people recorded for the company")
+    .option("--json", "Output JSON instead of a table")
+    .action((opts: { json?: boolean }) => {
+      try {
+        const scope = people.opts() as PeopleScopeOpts;
+        const hqRoot = resolveHqRoot(scope);
+        const slug = resolveCompanySlug(hqRoot, scope.company);
+        const records = listCompanyPeople(hqRoot, slug);
+
+        if (opts.json) {
+          console.log(JSON.stringify(records, null, 2));
+          return;
+        }
+        if (records.length === 0) {
+          console.log(
+            chalk.gray(
+              `No people recorded for '${slug}' (looked in ${companyPeopleDir(hqRoot, slug)}).`,
+            ),
+          );
+          return;
+        }
+        printPeopleTable(records);
+      } catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+      }
+    });
+
+  people
+    .command("search <keyword>")
+    .description("Keyword search over people names and emails")
+    .option("--json", "Output JSON instead of a table")
+    .action((keyword: string, opts: { json?: boolean }) => {
+      try {
+        const scope = people.opts() as PeopleScopeOpts;
+        const hqRoot = resolveHqRoot(scope);
+        const slug = resolveCompanySlug(hqRoot, scope.company);
+        const matches = searchPeople(listCompanyPeople(hqRoot, slug), keyword);
+
+        if (opts.json) {
+          console.log(JSON.stringify(matches, null, 2));
+          return;
+        }
+        if (matches.length === 0) {
+          console.log(chalk.gray(`No people in '${slug}' match "${keyword}".`));
+          return;
+        }
+        printPeopleTable(matches);
+      } catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+      }
+    });
+
+  people
+    .command("resolve <name>")
+    .description("Resolve a person name to their email address")
+    .option("--json", "Output JSON instead of plain text")
+    .action((name: string, opts: { json?: boolean }) => {
+      try {
+        const scope = people.opts() as PeopleScopeOpts;
+        const hqRoot = resolveHqRoot(scope);
+        const slug = resolveCompanySlug(hqRoot, scope.company);
+        const result = resolveNameToEmail(listCompanyPeople(hqRoot, slug), name);
+
+        if (opts.json) {
+          console.log(JSON.stringify(result, null, 2));
+          if (result.status === "found") return;
+          process.exit(1);
+        }
+
+        switch (result.status) {
+          case "found":
+            // Bare email on stdout so callers can capture it directly.
+            console.log(result.email);
+            return;
+          case "no_email":
+            fail(
+              `Found '${result.person.name}' in '${slug}' but no email is recorded for them.`,
+            );
+            break;
+          case "ambiguous":
+            console.error(
+              chalk.yellow(
+                `"${name}" matches ${result.matches.length} people in '${slug}' — be more specific:`,
+              ),
+            );
+            for (const m of result.matches) {
+              console.error(`  ${m.name}${m.email ? ` <${m.email}>` : ""}`);
+            }
+            process.exit(1);
+            break;
+          case "not_found":
+            fail(`No person matching "${name}" found in '${slug}'.`);
+            break;
+        }
+      } catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+      }
+    });
+}

package/src/commands/secrets.test.ts

@@ -160,6 +160,86 @@ describe("secrets exists (HQ-4H HEAD probe)", () => {
   });
 });
 
+// US-003 (secrets-server-proxy): the CLI surfaces the SERVER's refusal of a
+// high-security ("nuclear") secret on the local-injection path as a clear,
+// actionable error pointing at the proxy — and never prints the value. The
+// server-side deny is the real control (it returns 403 + highSecurity:true and
+// NO plaintext); these tests assert the CLI's surfacing behavior.
+describe("US-003 — CLI refuses high-security secrets on local injection", () => {
+  // The server's 403 refusal shape for a high-security secret.
+  function highSecurityDenied(): Response {
+    return new Response(
+      JSON.stringify({
+        error:
+          "Secret 'ANTHROPIC_API_KEY' is high-security and cannot be retrieved via local injection. Use the server-side proxy.",
+        highSecurity: true,
+      }),
+      { status: 403, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  let exitSpy: MockInstance<typeof process.exit>;
+  beforeEach(() => {
+    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("__exit__");
+    }) as never);
+  });
+
+  it("E2E: `secrets get --reveal` is denied — clear proxy-pointing error, no value printed", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(highSecurityDenied());
+
+    const program = buildProgram();
+    try {
+      await program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "get",
+        "ANTHROPIC_API_KEY",
+        "--reveal",
+      ]);
+    } catch {
+      // exit sentinel
+    }
+    const exitCode = exitSpy.mock.calls[0]?.[0] as number | undefined;
+
+    expect(exitCode).toBe(1);
+    // A clear, actionable error mentioning high-security + the proxy.
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/high-security/i);
+    expect(errText).toMatch(/proxy/i);
+    // The value is NEVER printed — no "Value:" line carrying plaintext.
+    const logText = logSpy.mock.calls.flat().join(" ");
+    expect(logText).not.toMatch(/sk-ant/i);
+  });
+
+  it("E2E: `secrets exec --only <name> -- env` is denied — proxy-pointing error, command not run", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(highSecurityDenied());
+
+    const program = buildProgram();
+    try {
+      await program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "exec",
+        "--only",
+        "ANTHROPIC_API_KEY",
+        "--",
+        "env",
+      ]);
+    } catch {
+      // exit sentinel
+    }
+    const exitCode = exitSpy.mock.calls[0]?.[0] as number | undefined;
+
+    expect(exitCode).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/high-security/i);
+    expect(errText).toMatch(/proxy/i);
+  });
+});
+
 describe("secrets generate-link", () => {
   it("mints one-time submission links for personal secrets", async () => {
     const program = buildProgram();

package/src/commands/secrets.ts

@@ -392,6 +392,13 @@ export async function loadRevealedSecrets(
     if (!res.ok) {
       const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
       const message = extractApiMessage(body, res.statusText);
+      // High-security ("nuclear") refusal surfaced at the batch level (rather
+      // than per-name): point the caller at the proxy and never leak plaintext.
+      if (body.code === "high_security_denied" || body.highSecurity === true) {
+        throw new Error(
+          "A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.",
+        );
+      }
       if (
         res.status >= 400 &&
         res.status < 500 &&
@@ -428,6 +435,17 @@ export async function loadRevealedSecrets(
     for (const key of chunk) {
       if (resolved.has(key)) continue;
       const err = errorsByName.get(key);
+      // High-security ("nuclear") secret: the server refuses to vend it on the
+      // local-injection (batch-load) path — per-name code `high_security_denied`,
+      // no plaintext returned. Every caller of loadRevealedSecrets injects or
+      // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
+      // `secrets env`), so a high-security secret can NEVER be used here. Surface
+      // a clear, actionable error pointing at the proxy instead of a raw failure.
+      if (err?.code === "high_security_denied") {
+        throw new Error(
+          `Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`,
+        );
+      }
       const reason =
         err?.code === "not_found"
           ? "Secret not found"
@@ -538,6 +556,23 @@ export function registerSecretsCommand(program: Command): void {
 
         if (!res.ok) {
           const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+          // High-security ("nuclear") secret: the server refuses to reveal it on
+          // the local-injection path (403, no plaintext). Surface a clear,
+          // actionable error pointing the user at the proxy rather than a raw
+          // 4xx — the value can ONLY be used through the server-side proxy.
+          if (res.status === 403 && body.highSecurity === true) {
+            console.error(
+              chalk.red(
+                `Secret '${name}' is high-security and cannot be revealed locally.`,
+              ),
+            );
+            console.error(
+              chalk.dim(
+                "  It can only be used through the HQ secret proxy, which keeps the plaintext server-side.",
+              ),
+            );
+            process.exit(1);
+          }
           console.error(
             chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`),
           );

package/src/index.ts

@@ -36,6 +36,7 @@ import { registerGroupGrantsCommand } from "./commands/group-grants.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerFilesBrowseCommands } from "./commands/files-browse.js";
 import { registerMembersCommand } from "./commands/members.js";
+import { registerPeopleCommand } from "./commands/people.js";
 import { registerDmCommand } from "./commands/dm.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
 import { registerMeetingsCommand } from "./commands/meetings.js";
@@ -166,6 +167,9 @@ registerFilesBrowseCommands(filesCmd);
 
 // Membership management (subcommand group — hq members invite|list|revoke)
 registerMembersCommand(program);
+// People directory (subcommand group — hq people list|search|resolve), reading
+// the local companies/<co>/people store scoped to one company.
+registerPeopleCommand(program);
 registerDmCommand(program);
 
 // Onboarding (top-level — Cognito + vault-service provisioning)

package/src/run/hq-plugin.test.ts

@@ -153,4 +153,43 @@ describe('hq-plugin', () => {
     const fooErrors = (graph as any).configSchema['FOO'].errors as Array<{ message: string }>;
     expect(fooErrors.some((e) => e.message.includes('No read permission for secret "FOO"'))).toBe(true);
   });
+
+  // US-003 (secrets-server-proxy): the server refuses to batch-load a
+  // high-security ("nuclear") secret (code: high_security_denied, no plaintext).
+  // `hq run` injects plaintext into the child env, so it must surface this as a
+  // clear, actionable error pointing at the proxy — and never resolve a value.
+  it('high-security-denied: nuclear secret is surfaced as a proxy-pointing ResolutionError, no value', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nANTHROPIC_API_KEY=hq()\n`);
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => ({
+        secrets: [],
+        errors: [
+          {
+            name: 'ANTHROPIC_API_KEY',
+            code: 'high_security_denied',
+            message: 'high-security; use the proxy',
+          },
+        ],
+      }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+    await prewarmHqSecrets(graph, mocks, state);
+    await graph.resolveEnvValues();
+
+    const errs = (graph as any).configSchema['ANTHROPIC_API_KEY'].errors as Array<{ message: string }>;
+    expect(errs.some((e) => /high-security/i.test(e.message) && /proxy/i.test(e.message))).toBe(true);
+    // No plaintext value was resolved for the nuclear secret.
+    expect((graph.getResolvedEnvObject() as Record<string, unknown>).ANTHROPIC_API_KEY).toBeUndefined();
+  });
 });

package/src/run/hq-plugin.ts

@@ -85,6 +85,13 @@ export function installHqPlugin(graph: any /* EnvGraph */, opts: InstallHqPlugin
           if (err.code === 'not_found') {
             throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
           }
+          // High-security ("nuclear") secret: the server refuses to vend it on
+          // the local-injection path. It can ONLY be used through the
+          // server-side proxy, so `hq run` (which injects plaintext into the
+          // child env) can never load it. Surface a clear, actionable error.
+          if (err.code === 'high_security_denied') {
+            throw new ResolutionError(`Secret "${secretName}" is high-security and cannot be injected locally — it can only be used via the HQ secret proxy (POST /secrets/{companyUid}/proxy/{path}), which keeps the plaintext server-side. Remove it from this schema's locally-injected vars.`);
+          }
           throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
         }
         // Sentinel-check style throughout: `readCache` returns `string | null`

package/src/utils/feedback-diagnostics.test.ts

@@ -91,6 +91,17 @@ describe("collectDiagnostics", () => {
     if (saved !== undefined) process.env.npm_package_version = saved;
   });
 
+  it("attaches a versions block carrying the cli version (core/sync best-effort)", () => {
+    const blob = collectDiagnostics();
+    expect(blob.versions.cli).toBe(CLI_VERSION);
+    // core + sync are environment-dependent; they must be present as
+    // string | null, never undefined, so triage always gets the shape.
+    expect(blob.versions).toHaveProperty("core");
+    expect(blob.versions).toHaveProperty("sync");
+    expect(["string", "object"]).toContain(typeof blob.versions.core); // string | null
+    expect(["string", "object"]).toContain(typeof blob.versions.sync); // string | null
+  });
+
   it("cliVersion is unaffected by npm_package_version env var", () => {
     process.env.npm_package_version = "99.99.99";
     const blob = collectDiagnostics();

package/src/utils/feedback-diagnostics.ts

@@ -2,6 +2,7 @@ import * as os from "os";
 import { execFileSync } from "child_process";
 import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
+import { collectVersions, type VersionInfo } from "./feedback-versions.js";
 
 export interface GitContext {
   branch: string | null;
@@ -12,6 +13,12 @@ export interface GitContext {
 
 export interface DiagnosticsBlob {
   cliVersion: string;
+  /**
+   * The hq-cli, hq-core, and hq-sync versions from the submitter's
+   * environment. `cliVersion` above is retained for back-compat; new
+   * consumers should read `versions` (which carries core + sync too).
+   */
+  versions: VersionInfo;
   nodeVersion: string;
   os: { platform: string; release: string; arch: string };
   command: string[];
@@ -101,6 +108,7 @@ function collectGitContext(): GitContext {
 export function collectDiagnostics(): DiagnosticsBlob {
   return {
     cliVersion: CLI_VERSION,
+    versions: collectVersions(),
     nodeVersion: process.version,
     os: {
       platform: os.platform(),

package/src/utils/feedback-screenshots.test.ts

@@ -0,0 +1,134 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+vi.mock("./vault-api.js", () => ({
+  vaultApiFetch: vi.fn(),
+}));
+
+import { vaultApiFetch } from "./vault-api.js";
+import {
+  MAX_SCREENSHOTS,
+  contentTypeForPath,
+  loadScreenshots,
+  uploadScreenshots,
+} from "./feedback-screenshots.js";
+
+let tmp: string;
+
+beforeEach(() => {
+  tmp = fs.mkdtempSync(path.join(os.tmpdir(), "shots-"));
+  vi.mocked(vaultApiFetch).mockReset();
+});
+afterEach(() => {
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+function writePng(name: string, bytes = Buffer.from([0x89, 0x50, 0x4e, 0x47])): string {
+  const p = path.join(tmp, name);
+  fs.writeFileSync(p, bytes);
+  return p;
+}
+
+describe("contentTypeForPath", () => {
+  it("maps known image extensions (case-insensitive)", () => {
+    expect(contentTypeForPath("a.png")).toBe("image/png");
+    expect(contentTypeForPath("a.JPG")).toBe("image/jpeg");
+    expect(contentTypeForPath("a.jpeg")).toBe("image/jpeg");
+    expect(contentTypeForPath("a.webp")).toBe("image/webp");
+    expect(contentTypeForPath("a.gif")).toBe("image/gif");
+  });
+  it("rejects unsupported extensions", () => {
+    expect(() => contentTypeForPath("a.pdf")).toThrow(/unsupported screenshot type/);
+    expect(() => contentTypeForPath("a")).toThrow(/unsupported screenshot type/);
+  });
+});
+
+describe("loadScreenshots", () => {
+  it("reads valid images with their content types", () => {
+    const a = writePng("a.png");
+    const loaded = loadScreenshots([a]);
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0].contentType).toBe("image/png");
+    expect(loaded[0].bytes.byteLength).toBeGreaterThan(0);
+  });
+  it("rejects more than MAX_SCREENSHOTS", () => {
+    const paths = Array.from({ length: MAX_SCREENSHOTS + 1 }, (_, i) => writePng(`s${i}.png`));
+    expect(() => loadScreenshots(paths)).toThrow(new RegExp(`at most ${MAX_SCREENSHOTS}`));
+  });
+  it("rejects a missing file", () => {
+    expect(() => loadScreenshots([path.join(tmp, "nope.png")])).toThrow(/cannot read screenshot/);
+  });
+  it("rejects an empty file", () => {
+    expect(() => loadScreenshots([writePng("empty.png", Buffer.alloc(0))])).toThrow(/empty/);
+  });
+});
+
+describe("uploadScreenshots", () => {
+  it("returns [] without calling the API when no paths given", async () => {
+    const keys = await uploadScreenshots({ paths: [], token: "t" });
+    expect(keys).toEqual([]);
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("presigns, PUTs each image to S3, and returns the keys", async () => {
+    const a = writePng("a.png");
+    const b = writePng("b.jpg");
+    vi.mocked(vaultApiFetch).mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        screenshots: [
+          { key: "feedback-screenshots/prs_a/sub/0.png", url: "https://s3/put0", contentType: "image/png" },
+          { key: "feedback-screenshots/prs_a/sub/1.jpg", url: "https://s3/put1", contentType: "image/jpeg" },
+        ],
+      }),
+    } as unknown as Response);
+    const putCalls: Array<{ url: string; method?: string; contentType?: unknown }> = [];
+    const fetchImpl = vi.fn(async (url: string, init: { method?: string; headers?: Record<string, string> }) => {
+      putCalls.push({ url, method: init.method, contentType: init.headers?.["Content-Type"] });
+      return { ok: true, status: 200 } as Response;
+    }) as unknown as typeof fetch;
+
+    const keys = await uploadScreenshots({ paths: [a, b], token: "tok", fetchImpl });
+
+    expect(keys).toEqual([
+      "feedback-screenshots/prs_a/sub/0.png",
+      "feedback-screenshots/prs_a/sub/1.jpg",
+    ]);
+    // Presign request asked for the right content types.
+    const presignBody = vi.mocked(vaultApiFetch).mock.calls[0][0].body;
+    expect(presignBody).toEqual({ contentTypes: ["image/png", "image/jpeg"] });
+    // One PUT per image, to the presigned URL, with the right Content-Type.
+    expect(putCalls).toEqual([
+      { url: "https://s3/put0", method: "PUT", contentType: "image/png" },
+      { url: "https://s3/put1", method: "PUT", contentType: "image/jpeg" },
+    ]);
+  });
+
+  it("throws when the presign call fails", async () => {
+    const a = writePng("a.png");
+    vi.mocked(vaultApiFetch).mockResolvedValue({
+      ok: false,
+      statusText: "Bad Request",
+      json: async () => ({ error: "at most 5 screenshots are allowed" }),
+    } as unknown as Response);
+    await expect(uploadScreenshots({ paths: [a], token: "t" })).rejects.toThrow(
+      /Failed to presign screenshots: at most 5/,
+    );
+  });
+
+  it("throws when an S3 upload fails", async () => {
+    const a = writePng("a.png");
+    vi.mocked(vaultApiFetch).mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        screenshots: [{ key: "feedback-screenshots/prs_a/sub/0.png", url: "https://s3/put0", contentType: "image/png" }],
+      }),
+    } as unknown as Response);
+    const fetchImpl = vi.fn(async () => ({ ok: false, status: 403 }) as Response) as unknown as typeof fetch;
+    await expect(uploadScreenshots({ paths: [a], token: "t", fetchImpl })).rejects.toThrow(
+      /Failed to upload screenshot .*: HTTP 403/,
+    );
+  });
+});