@indigoai-us/hq-cli 5.47.16 → 5.47.17

package/src/commands/feedback.ts

@@ -4,6 +4,7 @@ import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+import { MAX_SCREENSHOTS, uploadScreenshots } from "../utils/feedback-screenshots.js";
 
 export const BODY_MAX_BYTES = 64 * 1024;
 
@@ -17,6 +18,8 @@ export interface FeedbackSubmitOptions {
   body: string;
   company?: string;
   token: string;
+  /** S3 object keys of already-uploaded screenshots (see uploadScreenshots). */
+  screenshots?: string[];
 }
 
 export async function readBodyFile(
@@ -46,6 +49,19 @@ export async function readBodyFile(
 export async function submitFeedback(
   opts: FeedbackSubmitOptions,
 ): Promise<FeedbackResult> {
+  // Validate the title locally, symmetric with the body check below. Commander's
+  // `requiredOption("--title")` only requires the flag to be PRESENT — an empty
+  // or whitespace-only value (`--title ""`, or a title the /hq-bug skill derived
+  // to nothing) passes the flag check, then the server rejects it with a 400
+  // "title (non-empty string) is required" that floods Sentry as a context-free
+  // warning (HQ-AB). Catch it here so the caller gets a clear, actionable error
+  // and the bad request never reaches the server.
+  if (opts.title.trim().length === 0) {
+    throw new Error(
+      "title must not be empty. Provide a short, non-whitespace title via --title.",
+    );
+  }
+
   if (opts.body.trim().length === 0) {
     throw new Error(
       "body must not be empty. Provide at least one non-whitespace character.",
@@ -70,6 +86,9 @@ export async function submitFeedback(
   if (opts.company) {
     requestBody.company = opts.company;
   }
+  if (opts.screenshots && opts.screenshots.length > 0) {
+    requestBody.screenshots = opts.screenshots;
+  }
 
   const res = await vaultApiFetch({
     token: opts.token,
@@ -104,19 +123,33 @@ function registerSubcommand(feedbackCmd: Command, type: "bug" | "feature"): void
       "Path to a markdown file with the body; use - to read from stdin",
     )
     .option("--company <slug>", "Company slug to associate with the report")
-    .action(async (opts: { title: string; bodyFile: string; company?: string }) => {
-      try {
-        const token = await ensureCognitoToken({ interactive: false });
-        const body = await readBodyFile(opts.bodyFile);
-        const result = await submitFeedback({
-          type,
-          title: opts.title,
-          body,
-          company: opts.company,
-          token,
-        });
-        console.log(`Submitted: ${result.id}`);
-      } catch (err) {
+    .option(
+      "--screenshot <path>",
+      `Attach a screenshot (repeatable, up to ${MAX_SCREENSHOTS}; .png/.jpg/.jpeg/.webp/.gif)`,
+      (value: string, prev: string[]) => [...prev, value],
+      [] as string[],
+    )
+    .action(
+      async (opts: { title: string; bodyFile: string; company?: string; screenshot: string[] }) => {
+        try {
+          const token = await ensureCognitoToken({ interactive: false });
+          const body = await readBodyFile(opts.bodyFile);
+          // Validate + upload screenshots (direct-to-S3 via presigned PUT)
+          // before submitting, so the row references uploaded objects.
+          const screenshots = await uploadScreenshots({
+            paths: opts.screenshot ?? [],
+            token,
+          });
+          const result = await submitFeedback({
+            type,
+            title: opts.title,
+            body,
+            company: opts.company,
+            token,
+            screenshots,
+          });
+          console.log(`Submitted: ${result.id}`);
+        } catch (err) {
         console.error(
           chalk.red("Error:"),
           err instanceof Error ? err.message : String(err),

package/src/commands/files-delete.test.ts

@@ -38,6 +38,7 @@ import { Command } from "commander";
 import {
   registerFilesCommand,
   runFilesDelete,
+  stripRedundantCompanyScope,
   FilesDeleteHttpError,
   formatFilesDeleteError,
   type FilesDeleteResponse,
@@ -242,6 +243,137 @@ describe("hq files delete — root/empty prefix rejected client-side", () => {
   }
 });
 
+// HQ-8F: a caller who pastes an HQ *local* tree path (`companies/<slug>/…`)
+// over-prefixes the bucket-relative vault key; the server rejects it with a 400
+// (INVALID_PREFIX_COMPANIES_SCOPED), the source of the recurring warning. The
+// CLI now strips the redundant scope BEFORE sending, so the local-looking path
+// is gracefully normalized to bucket-relative.
+describe("stripRedundantCompanyScope (HQ-8F, pure)", () => {
+  it("strips a leading companies/<slug>/ to the bucket-relative remainder", () => {
+    expect(stripRedundantCompanyScope("companies/acme/projects/foo")).toEqual({
+      prefix: "projects/foo",
+      strippedSlug: "acme",
+    });
+    expect(stripRedundantCompanyScope("companies/acme/projects/foo/*")).toEqual({
+      prefix: "projects/foo/*",
+      strippedSlug: "acme",
+    });
+  });
+
+  it("returns an EMPTY remainder for the company-root spellings (→ root-reject)", () => {
+    expect(stripRedundantCompanyScope("companies/acme")).toEqual({
+      prefix: "",
+      strippedSlug: "acme",
+    });
+    expect(stripRedundantCompanyScope("companies/acme/")).toEqual({
+      prefix: "",
+      strippedSlug: "acme",
+    });
+  });
+
+  it("leaves an already bucket-relative prefix untouched (null)", () => {
+    expect(stripRedundantCompanyScope("projects/foo/*")).toBeNull();
+    expect(stripRedundantCompanyScope("reports/q3/")).toBeNull();
+    // A non-scope path that merely starts with the word "companies" is NOT a
+    // scope prefix and must be left alone.
+    expect(stripRedundantCompanyScope("companiesreport/x")).toBeNull();
+  });
+});
+
+describe("hq files delete — HQ-8F company-scope normalization", () => {
+  it("strips companies/<slug>/ and sends the BUCKET-RELATIVE prefix (no 400)", async () => {
+    fetchSpy.mockResolvedValueOnce(membershipResponse());
+    fetchSpy.mockResolvedValueOnce(
+      deleteResponse({ dryRun: true, matched: 1, keys: ["projects/foo/a.md"] }),
+    );
+    fetchSpy.mockResolvedValueOnce(
+      deleteResponse({ matched: 1, deleted: 1, tombstoned: 1, keys: ["projects/foo/a.md"] }),
+    );
+
+    await runFilesDelete(
+      {
+        // Trailing slash → also exercises the `/` → `/*` glob normalization.
+        prefix: "companies/acme/projects/foo/",
+        dryRun: false,
+        yes: true,
+        companySlug: undefined,
+      },
+      { confirm: async () => true },
+    );
+
+    const bodies = deleteCallBodies();
+    // Both the preview and the delete carry the stripped, bucket-relative prefix.
+    expect(bodies.map((b) => b.prefix)).toEqual(["projects/foo/*", "projects/foo/*"]);
+    expect(printedErr()).toContain("stripped redundant 'companies/acme/'");
+  });
+
+  it("a bare companies/<slug> strips to empty → root-reject, no network call", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync(["files", "delete", "companies/acme", "--yes"], {
+        from: "user",
+      }),
+    ).rejects.toThrow(/__EXIT__:1/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(printedErr()).toContain("Refusing to delete the vault root");
+  });
+});
+
+// HQ-CA: the EXACT-KEY sibling of HQ-8F. When the over-prefixed path has no
+// trailing slash and no wildcard (a literal key like
+// `companies/<slug>/notes/foo.md`), the server takes the exact-key branch where
+// `validateObjectKey` — not `validatePrefix` — rejects it with a 400 ("Invalid
+// key: … do not prefix with 'companies/<slug>/'."). The same client-side strip
+// runs UPSTREAM of the server's exact-vs-glob split, so it normalizes the exact
+// key to bucket-relative and the 400 is never emitted. This locks that path,
+// which #117 only exercised via the trailing-slash (glob) spelling.
+describe("hq files delete — HQ-CA exact-key company-scope normalization", () => {
+  it("strips companies/<slug>/ from an EXACT key and sends the bucket-relative key (no glob, no 400)", async () => {
+    fetchSpy.mockResolvedValueOnce(membershipResponse());
+    fetchSpy.mockResolvedValueOnce(
+      deleteResponse({
+        dryRun: true,
+        mode: "exact",
+        prefix: "notes/foo.md",
+        matched: 1,
+        keys: ["notes/foo.md"],
+      }),
+    );
+    fetchSpy.mockResolvedValueOnce(
+      deleteResponse({
+        mode: "exact",
+        prefix: "notes/foo.md",
+        matched: 1,
+        deleted: 1,
+        tombstoned: 1,
+        keys: ["notes/foo.md"],
+      }),
+    );
+
+    await runFilesDelete(
+      {
+        // No trailing slash, no wildcard → server takes the EXACT-key branch.
+        prefix: "companies/acme/notes/foo.md",
+        dryRun: false,
+        yes: true,
+        companySlug: undefined,
+      },
+      { confirm: async () => true },
+    );
+
+    const bodies = deleteCallBodies();
+    // Preview + delete both carry the stripped, bucket-relative EXACT key —
+    // never the `companies/acme/...` over-prefix that 400s, and never glob-ified
+    // into a prefix delete.
+    expect(bodies.map((b) => b.prefix)).toEqual(["notes/foo.md", "notes/foo.md"]);
+    for (const b of bodies) {
+      expect(b.prefix.startsWith("companies/")).toBe(false);
+      expect(b.prefix).not.toContain("*");
+    }
+    expect(printedErr()).toContain("stripped redundant 'companies/acme/'");
+  });
+});
+
 describe("hq files delete — server error mapping", () => {
   it("403 surfaces a clear not-authorized message and exits 1", async () => {
     fetchSpy.mockResolvedValueOnce(membershipResponse());

package/src/commands/files.ts

@@ -782,17 +782,58 @@ function printKeyPreview(resp: FilesDeleteResponse): void {
   }
 }
 
+/**
+ * The vault bucket is already company-scoped, so a delete prefix must be
+ * BUCKET-RELATIVE (e.g. `projects/foo/*`). A caller who pastes an HQ *local*
+ * tree path (`companies/<slug>/projects/foo`) over-prefixes it; the server then
+ * rejects it with INVALID_PREFIX_COMPANIES_SCOPED (HTTP 400), the source of the
+ * recurring Sentry warning HQ-8F. Strip a redundant leading `companies/<slug>/`
+ * so the local-looking path is normalized to the bucket-relative key the vault
+ * actually stores. Returns the stripped slug for a one-line notice, or null when
+ * there was nothing to strip. Pure → unit-testable.
+ *
+ * This runs UPSTREAM of the server's exact-vs-glob branch, so it covers both
+ * the glob spelling (`companies/<slug>/projects/foo/*` → `validatePrefix`,
+ * HQ-8F) and the EXACT-key spelling (`companies/<slug>/notes/foo.md` →
+ * `validateObjectKey`, HQ-CA) with the same normalization.
+ */
+export function stripRedundantCompanyScope(
+  prefix: string,
+): { prefix: string; strippedSlug: string } | null {
+  const m = /^companies\/([^/]+)(?:\/(.*))?$/.exec(prefix);
+  if (!m) return null;
+  return { prefix: m[2] ?? "", strippedSlug: m[1] };
+}
+
 export async function runFilesDelete(
   params: RunFilesDeleteParams,
   deps: { confirm?: ConfirmFn } = {},
 ): Promise<void> {
   const confirm = deps.confirm ?? realConfirm;
 
+  // The vault is already company-scoped — a `companies/<slug>/` prefix is the HQ
+  // LOCAL tree layout, not a vault key, and the server 400s it (HQ-8F). Strip it
+  // here so a pasted local path is gracefully normalized to bucket-relative
+  // BEFORE the dry-run/preview (so the operator still sees the exact keys and
+  // confirms the right target). If stripping empties the prefix, the root-reject
+  // below catches it with a clear message.
+  const scope = stripRedundantCompanyScope(params.prefix);
+  if (scope) {
+    console.error(
+      chalk.yellow(
+        `Note: stripped redundant 'companies/${scope.strippedSlug}/' — the vault ` +
+          `is already company-scoped; using bucket-relative ` +
+          `'${scope.prefix || "(root)"}'.`,
+      ),
+    );
+  }
+  const rawPrefix = scope ? scope.prefix : params.prefix;
+
   // Normalize exactly as the share/unshare/acl paths do (trailing `/` → `/*`),
   // then reject the root/empty prefix CLIENT-side so a typo never reaches the
   // server as a vault-wide delete. The server enforces this too (defense in
   // depth), but failing fast here is clearer and avoids a wasted round-trip.
-  const normalized = normalizeFilePrefix(params.prefix);
+  const normalized = normalizeFilePrefix(rawPrefix);
   if (normalized === "" || normalized === "*" || normalized === "/*") {
     console.error(
       chalk.red(

package/src/commands/secrets.test.ts

@@ -160,6 +160,86 @@ describe("secrets exists (HQ-4H HEAD probe)", () => {
   });
 });
 
+// US-003 (secrets-server-proxy): the CLI surfaces the SERVER's refusal of a
+// high-security ("nuclear") secret on the local-injection path as a clear,
+// actionable error pointing at the proxy — and never prints the value. The
+// server-side deny is the real control (it returns 403 + highSecurity:true and
+// NO plaintext); these tests assert the CLI's surfacing behavior.
+describe("US-003 — CLI refuses high-security secrets on local injection", () => {
+  // The server's 403 refusal shape for a high-security secret.
+  function highSecurityDenied(): Response {
+    return new Response(
+      JSON.stringify({
+        error:
+          "Secret 'ANTHROPIC_API_KEY' is high-security and cannot be retrieved via local injection. Use the server-side proxy.",
+        highSecurity: true,
+      }),
+      { status: 403, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  let exitSpy: MockInstance<typeof process.exit>;
+  beforeEach(() => {
+    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("__exit__");
+    }) as never);
+  });
+
+  it("E2E: `secrets get --reveal` is denied — clear proxy-pointing error, no value printed", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(highSecurityDenied());
+
+    const program = buildProgram();
+    try {
+      await program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "get",
+        "ANTHROPIC_API_KEY",
+        "--reveal",
+      ]);
+    } catch {
+      // exit sentinel
+    }
+    const exitCode = exitSpy.mock.calls[0]?.[0] as number | undefined;
+
+    expect(exitCode).toBe(1);
+    // A clear, actionable error mentioning high-security + the proxy.
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/high-security/i);
+    expect(errText).toMatch(/proxy/i);
+    // The value is NEVER printed — no "Value:" line carrying plaintext.
+    const logText = logSpy.mock.calls.flat().join(" ");
+    expect(logText).not.toMatch(/sk-ant/i);
+  });
+
+  it("E2E: `secrets exec --only <name> -- env` is denied — proxy-pointing error, command not run", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(highSecurityDenied());
+
+    const program = buildProgram();
+    try {
+      await program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "exec",
+        "--only",
+        "ANTHROPIC_API_KEY",
+        "--",
+        "env",
+      ]);
+    } catch {
+      // exit sentinel
+    }
+    const exitCode = exitSpy.mock.calls[0]?.[0] as number | undefined;
+
+    expect(exitCode).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/high-security/i);
+    expect(errText).toMatch(/proxy/i);
+  });
+});
+
 describe("secrets generate-link", () => {
   it("mints one-time submission links for personal secrets", async () => {
     const program = buildProgram();

package/src/commands/secrets.ts

@@ -392,6 +392,13 @@ export async function loadRevealedSecrets(
     if (!res.ok) {
       const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
       const message = extractApiMessage(body, res.statusText);
+      // High-security ("nuclear") refusal surfaced at the batch level (rather
+      // than per-name): point the caller at the proxy and never leak plaintext.
+      if (body.code === "high_security_denied" || body.highSecurity === true) {
+        throw new Error(
+          "A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.",
+        );
+      }
       if (
         res.status >= 400 &&
         res.status < 500 &&
@@ -428,6 +435,17 @@ export async function loadRevealedSecrets(
     for (const key of chunk) {
       if (resolved.has(key)) continue;
       const err = errorsByName.get(key);
+      // High-security ("nuclear") secret: the server refuses to vend it on the
+      // local-injection (batch-load) path — per-name code `high_security_denied`,
+      // no plaintext returned. Every caller of loadRevealedSecrets injects or
+      // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
+      // `secrets env`), so a high-security secret can NEVER be used here. Surface
+      // a clear, actionable error pointing at the proxy instead of a raw failure.
+      if (err?.code === "high_security_denied") {
+        throw new Error(
+          `Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`,
+        );
+      }
       const reason =
         err?.code === "not_found"
           ? "Secret not found"
@@ -538,6 +556,23 @@ export function registerSecretsCommand(program: Command): void {
 
         if (!res.ok) {
           const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+          // High-security ("nuclear") secret: the server refuses to reveal it on
+          // the local-injection path (403, no plaintext). Surface a clear,
+          // actionable error pointing the user at the proxy rather than a raw
+          // 4xx — the value can ONLY be used through the server-side proxy.
+          if (res.status === 403 && body.highSecurity === true) {
+            console.error(
+              chalk.red(
+                `Secret '${name}' is high-security and cannot be revealed locally.`,
+              ),
+            );
+            console.error(
+              chalk.dim(
+                "  It can only be used through the HQ secret proxy, which keeps the plaintext server-side.",
+              ),
+            );
+            process.exit(1);
+          }
           console.error(
             chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`),
           );

package/src/run/hq-plugin.test.ts

@@ -153,4 +153,43 @@ describe('hq-plugin', () => {
     const fooErrors = (graph as any).configSchema['FOO'].errors as Array<{ message: string }>;
     expect(fooErrors.some((e) => e.message.includes('No read permission for secret "FOO"'))).toBe(true);
   });
+
+  // US-003 (secrets-server-proxy): the server refuses to batch-load a
+  // high-security ("nuclear") secret (code: high_security_denied, no plaintext).
+  // `hq run` injects plaintext into the child env, so it must surface this as a
+  // clear, actionable error pointing at the proxy — and never resolve a value.
+  it('high-security-denied: nuclear secret is surfaced as a proxy-pointing ResolutionError, no value', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nANTHROPIC_API_KEY=hq()\n`);
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => ({
+        secrets: [],
+        errors: [
+          {
+            name: 'ANTHROPIC_API_KEY',
+            code: 'high_security_denied',
+            message: 'high-security; use the proxy',
+          },
+        ],
+      }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+    await prewarmHqSecrets(graph, mocks, state);
+    await graph.resolveEnvValues();
+
+    const errs = (graph as any).configSchema['ANTHROPIC_API_KEY'].errors as Array<{ message: string }>;
+    expect(errs.some((e) => /high-security/i.test(e.message) && /proxy/i.test(e.message))).toBe(true);
+    // No plaintext value was resolved for the nuclear secret.
+    expect((graph.getResolvedEnvObject() as Record<string, unknown>).ANTHROPIC_API_KEY).toBeUndefined();
+  });
 });

package/src/run/hq-plugin.ts

@@ -85,6 +85,13 @@ export function installHqPlugin(graph: any /* EnvGraph */, opts: InstallHqPlugin
           if (err.code === 'not_found') {
             throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
           }
+          // High-security ("nuclear") secret: the server refuses to vend it on
+          // the local-injection path. It can ONLY be used through the
+          // server-side proxy, so `hq run` (which injects plaintext into the
+          // child env) can never load it. Surface a clear, actionable error.
+          if (err.code === 'high_security_denied') {
+            throw new ResolutionError(`Secret "${secretName}" is high-security and cannot be injected locally — it can only be used via the HQ secret proxy (POST /secrets/{companyUid}/proxy/{path}), which keeps the plaintext server-side. Remove it from this schema's locally-injected vars.`);
+          }
           throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
         }
         // Sentinel-check style throughout: `readCache` returns `string | null`

package/src/utils/feedback-diagnostics.test.ts

@@ -91,6 +91,17 @@ describe("collectDiagnostics", () => {
     if (saved !== undefined) process.env.npm_package_version = saved;
   });
 
+  it("attaches a versions block carrying the cli version (core/sync best-effort)", () => {
+    const blob = collectDiagnostics();
+    expect(blob.versions.cli).toBe(CLI_VERSION);
+    // core + sync are environment-dependent; they must be present as
+    // string | null, never undefined, so triage always gets the shape.
+    expect(blob.versions).toHaveProperty("core");
+    expect(blob.versions).toHaveProperty("sync");
+    expect(["string", "object"]).toContain(typeof blob.versions.core); // string | null
+    expect(["string", "object"]).toContain(typeof blob.versions.sync); // string | null
+  });
+
   it("cliVersion is unaffected by npm_package_version env var", () => {
     process.env.npm_package_version = "99.99.99";
     const blob = collectDiagnostics();

package/src/utils/feedback-diagnostics.ts

@@ -2,6 +2,7 @@ import * as os from "os";
 import { execFileSync } from "child_process";
 import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
+import { collectVersions, type VersionInfo } from "./feedback-versions.js";
 
 export interface GitContext {
   branch: string | null;
@@ -12,6 +13,12 @@ export interface GitContext {
 
 export interface DiagnosticsBlob {
   cliVersion: string;
+  /**
+   * The hq-cli, hq-core, and hq-sync versions from the submitter's
+   * environment. `cliVersion` above is retained for back-compat; new
+   * consumers should read `versions` (which carries core + sync too).
+   */
+  versions: VersionInfo;
   nodeVersion: string;
   os: { platform: string; release: string; arch: string };
   command: string[];
@@ -101,6 +108,7 @@ function collectGitContext(): GitContext {
 export function collectDiagnostics(): DiagnosticsBlob {
   return {
     cliVersion: CLI_VERSION,
+    versions: collectVersions(),
     nodeVersion: process.version,
     os: {
       platform: os.platform(),