@indigoai-us/hq-cli 5.47.16 → 5.47.17

package/.github/workflows/publish.yml

@@ -104,8 +104,8 @@ jobs:
           fi
           export SENTRY_AUTH_TOKEN
           VER=$(jq -r .version package.json)
-          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/
+          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/ node_modules/@indigoai-us/hq-cloud/dist/
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: indigo-d0
-          SENTRY_PROJECT: hq
+          SENTRY_PROJECT: hq-cli

package/dist/commands/feedback.d.ts

@@ -9,6 +9,8 @@ export interface FeedbackSubmitOptions {
     body: string;
     company?: string;
     token: string;
+    /** S3 object keys of already-uploaded screenshots (see uploadScreenshots). */
+    screenshots?: string[];
 }
 export declare function readBodyFile(bodyFile: string, stdin?: NodeJS.ReadableStream): Promise<string>;
 export declare function submitFeedback(opts: FeedbackSubmitOptions): Promise<FeedbackResult>;

package/dist/commands/feedback.js

@@ -1,10 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ee78c7b6-6e93-5217-8a1d-ddc51afcf9c3")}catch(e){}}();
 import * as fs from "node:fs";
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+import { MAX_SCREENSHOTS, uploadScreenshots } from "../utils/feedback-screenshots.js";
 export const BODY_MAX_BYTES = 64 * 1024;
 export async function readBodyFile(bodyFile, stdin) {
     if (bodyFile === "-") {
@@ -25,6 +26,16 @@ export async function readBodyFile(bodyFile, stdin) {
     return fs.promises.readFile(bodyFile, "utf-8");
 }
 export async function submitFeedback(opts) {
+    // Validate the title locally, symmetric with the body check below. Commander's
+    // `requiredOption("--title")` only requires the flag to be PRESENT — an empty
+    // or whitespace-only value (`--title ""`, or a title the /hq-bug skill derived
+    // to nothing) passes the flag check, then the server rejects it with a 400
+    // "title (non-empty string) is required" that floods Sentry as a context-free
+    // warning (HQ-AB). Catch it here so the caller gets a clear, actionable error
+    // and the bad request never reaches the server.
+    if (opts.title.trim().length === 0) {
+        throw new Error("title must not be empty. Provide a short, non-whitespace title via --title.");
+    }
     if (opts.body.trim().length === 0) {
         throw new Error("body must not be empty. Provide at least one non-whitespace character.");
     }
@@ -42,6 +53,9 @@ export async function submitFeedback(opts) {
     if (opts.company) {
         requestBody.company = opts.company;
     }
+    if (opts.screenshots && opts.screenshots.length > 0) {
+        requestBody.screenshots = opts.screenshots;
+    }
     const res = await vaultApiFetch({
         token: opts.token,
         path: "/v1/feedback",
@@ -68,16 +82,24 @@ function registerSubcommand(feedbackCmd, type) {
         .requiredOption("--title <text>", "Short title for the report")
         .requiredOption("--body-file <path>", "Path to a markdown file with the body; use - to read from stdin")
         .option("--company <slug>", "Company slug to associate with the report")
+        .option("--screenshot <path>", `Attach a screenshot (repeatable, up to ${MAX_SCREENSHOTS}; .png/.jpg/.jpeg/.webp/.gif)`, (value, prev) => [...prev, value], [])
         .action(async (opts) => {
         try {
             const token = await ensureCognitoToken({ interactive: false });
             const body = await readBodyFile(opts.bodyFile);
+            // Validate + upload screenshots (direct-to-S3 via presigned PUT)
+            // before submitting, so the row references uploaded objects.
+            const screenshots = await uploadScreenshots({
+                paths: opts.screenshot ?? [],
+                token,
+            });
             const result = await submitFeedback({
                 type,
                 title: opts.title,
                 body,
                 company: opts.company,
                 token,
+                screenshots,
             });
             console.log(`Submitted: ${result.id}`);
         }
@@ -95,4 +117,4 @@ export function registerFeedbackCommand(program) {
     registerSubcommand(feedbackCmd, "feature");
 }
 //# sourceMappingURL=feedback.js.map
-//# debugId=3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4
+//# debugId=ee78c7b6-6e93-5217-8a1d-ddc51afcf9c3

package/dist/commands/files.d.ts

@@ -68,6 +68,25 @@ interface RunFilesDeleteParams {
     yes: boolean;
     companySlug: string | undefined;
 }
+/**
+ * The vault bucket is already company-scoped, so a delete prefix must be
+ * BUCKET-RELATIVE (e.g. `projects/foo/*`). A caller who pastes an HQ *local*
+ * tree path (`companies/<slug>/projects/foo`) over-prefixes it; the server then
+ * rejects it with INVALID_PREFIX_COMPANIES_SCOPED (HTTP 400), the source of the
+ * recurring Sentry warning HQ-8F. Strip a redundant leading `companies/<slug>/`
+ * so the local-looking path is normalized to the bucket-relative key the vault
+ * actually stores. Returns the stripped slug for a one-line notice, or null when
+ * there was nothing to strip. Pure → unit-testable.
+ *
+ * This runs UPSTREAM of the server's exact-vs-glob branch, so it covers both
+ * the glob spelling (`companies/<slug>/projects/foo/*` → `validatePrefix`,
+ * HQ-8F) and the EXACT-key spelling (`companies/<slug>/notes/foo.md` →
+ * `validateObjectKey`, HQ-CA) with the same normalization.
+ */
+export declare function stripRedundantCompanyScope(prefix: string): {
+    prefix: string;
+    strippedSlug: string;
+} | null;
 export declare function runFilesDelete(params: RunFilesDeleteParams, deps?: {
     confirm?: ConfirmFn;
 }): Promise<void>;

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5f5242f3-b24f-58b0-a3ee-381c42c755fc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6")}catch(e){}}();
 import chalk from "chalk";
 import open from "open";
 import * as readline from "node:readline";
@@ -566,13 +566,47 @@ function printKeyPreview(resp) {
         console.log(chalk.dim(`    … and ${resp.matched - resp.keys.length} more`));
     }
 }
+/**
+ * The vault bucket is already company-scoped, so a delete prefix must be
+ * BUCKET-RELATIVE (e.g. `projects/foo/*`). A caller who pastes an HQ *local*
+ * tree path (`companies/<slug>/projects/foo`) over-prefixes it; the server then
+ * rejects it with INVALID_PREFIX_COMPANIES_SCOPED (HTTP 400), the source of the
+ * recurring Sentry warning HQ-8F. Strip a redundant leading `companies/<slug>/`
+ * so the local-looking path is normalized to the bucket-relative key the vault
+ * actually stores. Returns the stripped slug for a one-line notice, or null when
+ * there was nothing to strip. Pure → unit-testable.
+ *
+ * This runs UPSTREAM of the server's exact-vs-glob branch, so it covers both
+ * the glob spelling (`companies/<slug>/projects/foo/*` → `validatePrefix`,
+ * HQ-8F) and the EXACT-key spelling (`companies/<slug>/notes/foo.md` →
+ * `validateObjectKey`, HQ-CA) with the same normalization.
+ */
+export function stripRedundantCompanyScope(prefix) {
+    const m = /^companies\/([^/]+)(?:\/(.*))?$/.exec(prefix);
+    if (!m)
+        return null;
+    return { prefix: m[2] ?? "", strippedSlug: m[1] };
+}
 export async function runFilesDelete(params, deps = {}) {
     const confirm = deps.confirm ?? realConfirm;
+    // The vault is already company-scoped — a `companies/<slug>/` prefix is the HQ
+    // LOCAL tree layout, not a vault key, and the server 400s it (HQ-8F). Strip it
+    // here so a pasted local path is gracefully normalized to bucket-relative
+    // BEFORE the dry-run/preview (so the operator still sees the exact keys and
+    // confirms the right target). If stripping empties the prefix, the root-reject
+    // below catches it with a clear message.
+    const scope = stripRedundantCompanyScope(params.prefix);
+    if (scope) {
+        console.error(chalk.yellow(`Note: stripped redundant 'companies/${scope.strippedSlug}/' — the vault ` +
+            `is already company-scoped; using bucket-relative ` +
+            `'${scope.prefix || "(root)"}'.`));
+    }
+    const rawPrefix = scope ? scope.prefix : params.prefix;
     // Normalize exactly as the share/unshare/acl paths do (trailing `/` → `/*`),
     // then reject the root/empty prefix CLIENT-side so a typo never reaches the
     // server as a vault-wide delete. The server enforces this too (defense in
     // depth), but failing fast here is clearer and avoids a wasted round-trip.
-    const normalized = normalizeFilePrefix(params.prefix);
+    const normalized = normalizeFilePrefix(rawPrefix);
     if (normalized === "" || normalized === "*" || normalized === "/*") {
         console.error(chalk.red("Refusing to delete the vault root. Pass a bounded prefix (e.g. 'projects/foo/' or 'projects/foo/*') or an exact key."));
         process.exit(1);
@@ -648,4 +682,4 @@ export async function runFilesDelete(params, deps = {}) {
     }
 }
 //# sourceMappingURL=files.js.map
-//# debugId=5f5242f3-b24f-58b0-a3ee-381c42c755fc
+//# debugId=bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d01cb1a1-b851-5ffe-9608-e505e55dcdc8")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3049e431-c5db-5430-90fe-82866c35e95b")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -251,6 +251,11 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
         if (!res.ok) {
             const body = (await res.json().catch(() => ({})));
             const message = extractApiMessage(body, res.statusText);
+            // High-security ("nuclear") refusal surfaced at the batch level (rather
+            // than per-name): point the caller at the proxy and never leak plaintext.
+            if (body.code === "high_security_denied" || body.highSecurity === true) {
+                throw new Error("A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.");
+            }
             if (res.status >= 400 &&
                 res.status < 500 &&
                 typeof body.code === "string") {
@@ -280,6 +285,15 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
             if (resolved.has(key))
                 continue;
             const err = errorsByName.get(key);
+            // High-security ("nuclear") secret: the server refuses to vend it on the
+            // local-injection (batch-load) path — per-name code `high_security_denied`,
+            // no plaintext returned. Every caller of loadRevealedSecrets injects or
+            // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
+            // `secrets env`), so a high-security secret can NEVER be used here. Surface
+            // a clear, actionable error pointing at the proxy instead of a raw failure.
+            if (err?.code === "high_security_denied") {
+                throw new Error(`Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`);
+            }
             const reason = err?.code === "not_found"
                 ? "Secret not found"
                 : err?.code === "forbidden"
@@ -364,6 +378,15 @@ export function registerSecretsCommand(program) {
             });
             if (!res.ok) {
                 const body = (await res.json().catch(() => ({})));
+                // High-security ("nuclear") secret: the server refuses to reveal it on
+                // the local-injection path (403, no plaintext). Surface a clear,
+                // actionable error pointing the user at the proxy rather than a raw
+                // 4xx — the value can ONLY be used through the server-side proxy.
+                if (res.status === 403 && body.highSecurity === true) {
+                    console.error(chalk.red(`Secret '${name}' is high-security and cannot be revealed locally.`));
+                    console.error(chalk.dim("  It can only be used through the HQ secret proxy, which keeps the plaintext server-side."));
+                    process.exit(1);
+                }
                 console.error(chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
@@ -1125,4 +1148,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=d01cb1a1-b851-5ffe-9608-e505e55dcdc8
+//# debugId=3049e431-c5db-5430-90fe-82866c35e95b

package/dist/run/hq-plugin.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="63aeb21a-b1e7-5bff-8c7d-560fad3cc0dd")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="20ece834-f9b5-5295-8620-87eb4f13ba7c")}catch(e){}}();
 import { ResolutionError } from 'varlock/plugin-lib';
 import { DEFAULT_SECRETS_CACHE_TTL_MS, readCache, writeCache, } from '../utils/secrets-cache.js';
 function normalizeCacheTtlMs(cacheTtlMs) {
@@ -59,6 +59,13 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
                     if (err.code === 'not_found') {
                         throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
                     }
+                    // High-security ("nuclear") secret: the server refuses to vend it on
+                    // the local-injection path. It can ONLY be used through the
+                    // server-side proxy, so `hq run` (which injects plaintext into the
+                    // child env) can never load it. Surface a clear, actionable error.
+                    if (err.code === 'high_security_denied') {
+                        throw new ResolutionError(`Secret "${secretName}" is high-security and cannot be injected locally — it can only be used via the HQ secret proxy (POST /secrets/{companyUid}/proxy/{path}), which keeps the plaintext server-side. Remove it from this schema's locally-injected vars.`);
+                    }
                     throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
                 }
                 // Sentinel-check style throughout: `readCache` returns `string | null`
@@ -158,4 +165,4 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
     state.uid = uid;
 }
 //# sourceMappingURL=hq-plugin.js.map
-//# debugId=63aeb21a-b1e7-5bff-8c7d-560fad3cc0dd
+//# debugId=20ece834-f9b5-5295-8620-87eb4f13ba7c

package/dist/sentry-dsn.generated.d.ts

@@ -1,2 +1,2 @@
-export declare const BUNDLED_DSN = "https://ed8c1f7624b67945b43d485bbf98d0f7@o4507292345892864.ingest.us.sentry.io/4511263744786432";
+export declare const BUNDLED_DSN = "https://467061dc39fb64644f5640a82d8949cf@o4507292345892864.ingest.us.sentry.io/4511597516226560";
 //# sourceMappingURL=sentry-dsn.generated.d.ts.map

package/dist/sentry-dsn.generated.js

@@ -1,5 +1,5 @@
 
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="55f2362e-5cf7-5dac-b6a3-ef0f9ccde645")}catch(e){}}();
-export const BUNDLED_DSN = "https://ed8c1f7624b67945b43d485bbf98d0f7@o4507292345892864.ingest.us.sentry.io/4511263744786432";
+export const BUNDLED_DSN = "https://467061dc39fb64644f5640a82d8949cf@o4507292345892864.ingest.us.sentry.io/4511597516226560";
 //# sourceMappingURL=sentry-dsn.generated.js.map
 //# debugId=55f2362e-5cf7-5dac-b6a3-ef0f9ccde645

package/dist/utils/feedback-diagnostics.d.ts

@@ -1,3 +1,4 @@
+import { type VersionInfo } from "./feedback-versions.js";
 export interface GitContext {
     branch: string | null;
     head: string | null;
@@ -6,6 +7,12 @@ export interface GitContext {
 }
 export interface DiagnosticsBlob {
     cliVersion: string;
+    /**
+     * The hq-cli, hq-core, and hq-sync versions from the submitter's
+     * environment. `cliVersion` above is retained for back-compat; new
+     * consumers should read `versions` (which carries core + sync too).
+     */
+    versions: VersionInfo;
     nodeVersion: string;
     os: {
         platform: string;

package/dist/utils/feedback-diagnostics.js

@@ -1,9 +1,10 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ee39c63b-ddaa-553d-b5db-77633d323d88")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ae4c924b-fe3d-558c-8b44-e1bac1f5a73e")}catch(e){}}();
 import * as os from "os";
 import { execFileSync } from "child_process";
 import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
+import { collectVersions } from "./feedback-versions.js";
 const SECRET_FLAGS = new Set([
     "--token",
     "--secret",
@@ -79,6 +80,7 @@ function collectGitContext() {
 export function collectDiagnostics() {
     return {
         cliVersion: CLI_VERSION,
+        versions: collectVersions(),
         nodeVersion: process.version,
         os: {
             platform: os.platform(),
@@ -92,4 +94,4 @@ export function collectDiagnostics() {
     };
 }
 //# sourceMappingURL=feedback-diagnostics.js.map
-//# debugId=ee39c63b-ddaa-553d-b5db-77633d323d88
+//# debugId=ae4c924b-fe3d-558c-8b44-e1bac1f5a73e

package/dist/utils/feedback-screenshots.d.ts

@@ -0,0 +1,23 @@
+export declare const MAX_SCREENSHOTS = 5;
+export declare const MAX_SCREENSHOT_BYTES: number;
+export declare function contentTypeForPath(filePath: string): string;
+export interface ScreenshotInput {
+    path: string;
+    contentType: string;
+    bytes: Buffer;
+}
+/** Validate + read the given screenshot paths (count, type, existence, size). */
+export declare function loadScreenshots(paths: string[]): ScreenshotInput[];
+/**
+ * Validate the screenshot paths, request presigned PUT URLs from the feedback
+ * endpoint, upload each image direct to S3, and return the object keys to
+ * attach to the feedback submission. Returns [] for no screenshots.
+ *
+ * `fetchImpl` is injectable for tests; defaults to the global fetch.
+ */
+export declare function uploadScreenshots(opts: {
+    paths: string[];
+    token: string;
+    fetchImpl?: typeof fetch;
+}): Promise<string[]>;
+//# sourceMappingURL=feedback-screenshots.d.ts.map

package/dist/utils/feedback-screenshots.js

@@ -0,0 +1,98 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="13f46978-c3c8-532d-b0bb-e8febf876587")}catch(e){}}();
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { vaultApiFetch } from "./vault-api.js";
+export const MAX_SCREENSHOTS = 5;
+// Per-image ceiling. Screenshots are PNG/JPEG captures; 10 MB is generous.
+export const MAX_SCREENSHOT_BYTES = 10 * 1024 * 1024;
+// Extension → content type. Must stay in sync with the server's allowed set
+// (hq-pro feedback-screenshots.ts ALLOWED_CONTENT_TYPES).
+const EXT_CONTENT_TYPE = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+};
+export function contentTypeForPath(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const contentType = EXT_CONTENT_TYPE[ext];
+    if (!contentType) {
+        throw new Error(`unsupported screenshot type: ${filePath} (allowed: ${Object.keys(EXT_CONTENT_TYPE).join(", ")})`);
+    }
+    return contentType;
+}
+/** Validate + read the given screenshot paths (count, type, existence, size). */
+export function loadScreenshots(paths) {
+    if (paths.length > MAX_SCREENSHOTS) {
+        throw new Error(`at most ${MAX_SCREENSHOTS} screenshots are allowed (got ${paths.length})`);
+    }
+    return paths.map((filePath) => {
+        const contentType = contentTypeForPath(filePath);
+        let bytes;
+        try {
+            bytes = fs.readFileSync(filePath);
+        }
+        catch {
+            throw new Error(`cannot read screenshot: ${filePath}`);
+        }
+        if (bytes.byteLength === 0) {
+            throw new Error(`screenshot is empty: ${filePath}`);
+        }
+        if (bytes.byteLength > MAX_SCREENSHOT_BYTES) {
+            throw new Error(`screenshot too large: ${filePath} (${bytes.byteLength} bytes, max ${MAX_SCREENSHOT_BYTES})`);
+        }
+        return { path: filePath, contentType, bytes };
+    });
+}
+/**
+ * Validate the screenshot paths, request presigned PUT URLs from the feedback
+ * endpoint, upload each image direct to S3, and return the object keys to
+ * attach to the feedback submission. Returns [] for no screenshots.
+ *
+ * `fetchImpl` is injectable for tests; defaults to the global fetch.
+ */
+export async function uploadScreenshots(opts) {
+    if (opts.paths.length === 0)
+        return [];
+    const inputs = loadScreenshots(opts.paths);
+    const res = await vaultApiFetch({
+        token: opts.token,
+        path: "/v1/feedback/screenshots/presign",
+        method: "POST",
+        body: { contentTypes: inputs.map((i) => i.contentType) },
+    });
+    if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        const msg = data &&
+            typeof data === "object" &&
+            typeof data.error === "string"
+            ? data.error
+            : res.statusText;
+        throw new Error(`Failed to presign screenshots: ${msg}`);
+    }
+    const parsed = (await res.json());
+    if (!parsed ||
+        !Array.isArray(parsed.screenshots) ||
+        parsed.screenshots.length !== inputs.length) {
+        throw new Error("Presign response did not match the requested screenshots");
+    }
+    const doFetch = opts.fetchImpl ?? fetch;
+    const keys = [];
+    for (let i = 0; i < inputs.length; i++) {
+        const slot = parsed.screenshots[i];
+        const put = await doFetch(slot.url, {
+            method: "PUT",
+            headers: { "Content-Type": slot.contentType },
+            body: inputs[i].bytes,
+        });
+        if (!put.ok) {
+            throw new Error(`Failed to upload screenshot ${inputs[i].path}: HTTP ${put.status}`);
+        }
+        keys.push(slot.key);
+    }
+    return keys;
+}
+//# sourceMappingURL=feedback-screenshots.js.map
+//# debugId=13f46978-c3c8-532d-b0bb-e8febf876587

package/dist/utils/feedback-versions.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The three HQ component versions captured from the submitter's environment
+ * and attached to a feedback submission so triage can see exactly which
+ * versions a report came from.
+ *
+ *   - `cli`  — this hq-cli build (always known).
+ *   - `core` — the HQ scaffold version from `core/core.yaml` (`hqVersion`);
+ *               null when the command runs outside an HQ tree.
+ *   - `sync` — the installed hq-sync menubar app version, which the app
+ *               records at `~/.hq/sync-version.json` on startup; null when
+ *               hq-sync is not installed (e.g. CLI-only / CI environments).
+ */
+export interface VersionInfo {
+    cli: string;
+    core: string | null;
+    sync: string | null;
+}
+/**
+ * Best-effort read of the hq-core scaffold version (`core/core.yaml`
+ * `hqVersion`). Resolves the HQ root from the working directory; returns
+ * null when no HQ root / core.yaml is found rather than throwing — version
+ * capture must never break a feedback submission.
+ */
+export declare function readCoreVersion(): string | null;
+/**
+ * Best-effort read of the hq-sync menubar app version. The app writes
+ * `{ version, updatedAt }` to `~/.hq/sync-version.json` on startup; the CLI
+ * reads it here. Returns null when the file is absent or malformed (hq-sync
+ * not installed, or an older build that predates the marker).
+ */
+export declare function readSyncVersion(homeDir?: string): string | null;
+/** Collect all three component versions, each independently best-effort. */
+export declare function collectVersions(): VersionInfo;
+//# sourceMappingURL=feedback-versions.d.ts.map

package/dist/utils/feedback-versions.js

@@ -0,0 +1,50 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ea3328d1-5c42-5d60-ad24-f96c11a37f22")}catch(e){}}();
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { CLI_VERSION } from "../cli-version.js";
+import { findHqRoot } from "./manifest.js";
+import { readHqVersion } from "./pack-contributions.js";
+/**
+ * Best-effort read of the hq-core scaffold version (`core/core.yaml`
+ * `hqVersion`). Resolves the HQ root from the working directory; returns
+ * null when no HQ root / core.yaml is found rather than throwing — version
+ * capture must never break a feedback submission.
+ */
+export function readCoreVersion() {
+    try {
+        return readHqVersion(findHqRoot());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Best-effort read of the hq-sync menubar app version. The app writes
+ * `{ version, updatedAt }` to `~/.hq/sync-version.json` on startup; the CLI
+ * reads it here. Returns null when the file is absent or malformed (hq-sync
+ * not installed, or an older build that predates the marker).
+ */
+export function readSyncVersion(homeDir = os.homedir()) {
+    try {
+        const raw = fs.readFileSync(path.join(homeDir, ".hq", "sync-version.json"), "utf-8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed.version === "string" && parsed.version.length > 0
+            ? parsed.version
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Collect all three component versions, each independently best-effort. */
+export function collectVersions() {
+    return {
+        cli: CLI_VERSION,
+        core: readCoreVersion(),
+        sync: readSyncVersion(),
+    };
+}
+//# sourceMappingURL=feedback-versions.js.map
+//# debugId=ea3328d1-5c42-5d60-ad24-f96c11a37f22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.16",
+  "version": "5.47.17",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/feedback.test.ts

@@ -156,6 +156,24 @@ describe("submitFeedback", () => {
     expect((call.body as Record<string, unknown>)).not.toHaveProperty("company");
   });
 
+  it("includes screenshot keys when provided, omits the key otherwise", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(jsonResponse(200, { id: "feedback_s1" }));
+    await submitFeedback({
+      type: "bug",
+      title: "With shots",
+      body: "Details",
+      token: "tok",
+      screenshots: ["feedback-screenshots/prs_a/sub/0.png"],
+    });
+    expect((mockVaultApiFetch.mock.calls[0][0].body as Record<string, unknown>).screenshots).toEqual([
+      "feedback-screenshots/prs_a/sub/0.png",
+    ]);
+
+    mockVaultApiFetch.mockResolvedValueOnce(jsonResponse(200, { id: "feedback_s2" }));
+    await submitFeedback({ type: "bug", title: "No shots", body: "Details", token: "tok", screenshots: [] });
+    expect(mockVaultApiFetch.mock.calls[1][0].body).not.toHaveProperty("screenshots");
+  });
+
   it("attaches diagnostics from collectDiagnostics to the request body", async () => {
     mockVaultApiFetch.mockResolvedValueOnce(
       jsonResponse(200, { id: "feedback_diag" }),
@@ -249,6 +267,32 @@ describe("submitFeedback", () => {
 
     expect(mockVaultApiFetch).not.toHaveBeenCalled();
   });
+
+  // HQ-AB: an empty/whitespace title (e.g. `--title ""`, or a title the /hq-bug
+  // skill derived to nothing) used to slip past Commander's required-flag check
+  // and 400 server-side, flooding Sentry with a context-free warning. The local
+  // guard now rejects it before any network call.
+  it("throws before fetching when title is empty or whitespace-only", async () => {
+    await expect(
+      submitFeedback({
+        type: "bug",
+        title: "   \n\t  ",
+        body: "Real body",
+        token: "tok",
+      }),
+    ).rejects.toThrow(/title must not be empty/);
+
+    await expect(
+      submitFeedback({
+        type: "feature",
+        title: "",
+        body: "Real body",
+        token: "tok",
+      }),
+    ).rejects.toThrow(/title must not be empty/);
+
+    expect(mockVaultApiFetch).not.toHaveBeenCalled();
+  });
 });
 
 // ---------------------------------------------------------------------------