@indigoai-us/hq-cli 5.47.16 → 5.48.0

package/.github/workflows/ci.yml

@@ -5,29 +5,25 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    runs-on: ubuntu-latest
+    name: build (node ${{ matrix.node-version }})
     strategy:
       fail-fast: false
       matrix:
         # 20 is the declared engines floor (package.json engines.node >=20),
-        # 22 is the current dev/publish baseline. Running the suite on 20
-        # enforces the floor so it stays real, not aspirational.
-        node-version: [20, 22]
-    name: build (node ${{ matrix.node-version }})
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
-      # generate-dsn.mjs only fatals when GITHUB_JOB=publish, so CI builds with
-      # an empty BUNDLED_DSN. That's intentional — the DSN is publish-only.
-      - run: pnpm run build
-      - run: pnpm run typecheck
-      - run: pnpm test
+        # 22 is the current dev/publish baseline.
+        node-version: ["20", "22"]
+    uses: indigoai-us/.github/.github/workflows/_node-ci.yml@main
+    with:
+      package-manager: pnpm
+      pnpm-version: "10"
+      node-version: ${{ matrix.node-version }}
+      run-build: true
+      run-lint: false
+      run-coverage: true
+    secrets: inherit

package/.github/workflows/publish.yml

@@ -2,110 +2,35 @@ name: Publish to npm
 on:
   push:
     tags: ["v*"]
+  # Manual dry-run: validate the build/pack/smoke pipeline without publishing.
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry-run (validate build/pack/smoke; npm publish --dry-run, no Sentry upload)"
+        type: boolean
+        default: true
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - uses: actions/setup-node@v4
-        with:
-          # Node 24 ships npm 11.x, required for npm's trusted-publisher OIDC
-          # token-exchange flow. See hq-cloud's publish.yml for the full
-          # rationale (npm 10.x produces masked-404 failures on publish PUT).
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-          cache: pnpm
-
-      - run: node --version && npm --version && pnpm --version
-      # Install with pnpm (supply-chain policy); npm publish keeps OIDC.
-      - run: pnpm install --frozen-lockfile --config.minimumReleaseAge=1440
-
-      - name: Build
-        run: pnpm run build
-        env:
-          # generate-dsn.mjs fatals when GITHUB_JOB=publish and this var is
-          # missing. Set this as a repo secret to bundle a Sentry DSN into the
-          # published binary.
-          HQ_CLI_PUBLISH_SENTRY_DSN: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
-
-      # Inject Sentry debug IDs into compiled JS + map files. Must run after
-      # tsc and BEFORE publish so the installed binary carries the same debugId
-      # as the artifacts uploaded to Sentry, enabling debugId-based source-map
-      # resolution for globally-installed CLI users.
-      - name: Inject Sentry source map debug IDs
-        run: npx -y @sentry/cli@^2 sourcemaps inject dist/
-
-      # Pre-publish cross-package smoke test (Bug A guard).
-      #
-      # @indigoai-us/hq-cli depends on @indigoai-us/hq-cloud via a caret range
-      # (^5.1.0). The smoke installs a freshly-packed tarball into an isolated
-      # tmpdir — outside this repo — so transitive @indigoai-us/* deps resolve
-      # from the npm registry, NOT from a local checkout. Booting `hq --version`
-      # then exercises the full module-load graph. If hq-cloud removed or
-      # renamed a symbol hq-cli imports, this catches it BEFORE the publish PUT.
-      #
-      # Bypass: set repo-or-workflow variable WORKFLOW_ALLOW_BROKEN_PUBLISH=1.
-      - name: Pre-publish smoke test
-        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH != '1' }}
-        run: bash .github/workflows/scripts/smoke-test-pkg.sh hq
-
-      - name: WARN — pre-publish smoke bypassed
-        if: ${{ vars.WORKFLOW_ALLOW_BROKEN_PUBLISH == '1' }}
-        run: |
-          echo "::warning::WORKFLOW_ALLOW_BROKEN_PUBLISH=1 — pre-publish cross-package smoke test was BYPASSED. This release may ship a DOA package."
-
-      # Trusted-publisher OIDC; no NODE_AUTH_TOKEN. No --provenance (private
-      # repo limitation since npm 2026-05-10). Pre-release versions (with '-')
-      # get --tag rc to keep latest dist-tag pointing at stable releases only.
-      - name: Publish to npm
-        id: publish
-        run: |
-          NAME=$(jq -r .name package.json)
-          VER=$(jq -r .version package.json)
-          if npm view "$NAME@$VER" version >/dev/null 2>&1; then
-            echo "$NAME@$VER already on npm — skipping"
-          else
-            if echo "$VER" | grep -q '-'; then
-              npm publish --access public --tag rc
-            else
-              npm publish --access public
-            fi
-            echo "published=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      # Sentry sourcemap upload runs on every tag push regardless of whether
-      # this run was the one that actually published to npm. The previous
-      # `if: steps.publish.outputs.published == 'true'` gate made re-runs
-      # useless when only the Sentry upload failed — the publish step's
-      # short-circuit (`npm view @ver already published`) zeroed out the
-      # output, so the upload step was skipped on every re-run. dist/ is
-      # rebuilt by the Build + Inject steps each run, so the upload is
-      # always operating on fresh, debug-id-stamped artifacts.
-      - name: Upload sourcemaps to Sentry
-        run: |
-          # Defang paste-time whitespace in SENTRY_AUTH_TOKEN. Sentry's
-          # auth-header parser returns HTTP 401 "Token string should not
-          # contain spaces" when the secret has a trailing \n or any
-          # embedded whitespace — observed on the v5.25.0 release after a
-          # copy-paste into the GH repo secret carried a literal \n. `tr -d`
-          # is the cheap structural guard so the workflow doesn't blow up
-          # on the next dirty paste.
-          SENTRY_AUTH_TOKEN=$(printf %s "$SENTRY_AUTH_TOKEN" | tr -d '[:space:]')
-          if [ -z "$SENTRY_AUTH_TOKEN" ]; then
-            echo "::error::SENTRY_AUTH_TOKEN secret is empty (or all whitespace) after sanitization — cannot upload sourcemaps"
-            exit 1
-          fi
-          export SENTRY_AUTH_TOKEN
-          VER=$(jq -r .version package.json)
-          npx -y @sentry/cli@^2 sourcemaps upload --release "hq-cli@$VER" dist/
-        env:
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_ORG: indigo-d0
-          SENTRY_PROJECT: hq
+    uses: indigoai-us/.github/.github/workflows/_npm-publish.yml@main
+    with:
+      package-manager: pnpm
+      pnpm-version: "10"
+      node-version: "24"
+      build-command: "pnpm run build"
+      dsn-env-name: "HQ_CLI_PUBLISH_SENTRY_DSN"
+      sentry-inject-dir: "dist/"
+      smoke-test-arg: "hq"
+      sentry-release-prefix: "hq-cli"
+      sentry-upload-paths: "dist/ node_modules/@indigoai-us/hq-cloud/dist/"
+      sentry-org: "indigo-d0"
+      sentry-project: "hq-cli"
+      # Prerelease versions (e.g. 5.x.y-rc.0) ship to the rc dist-tag, not latest.
+      prerelease-dist-tag: "rc"
+      dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+    secrets:
+      sentry-dsn: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
+      sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}

package/dist/commands/feedback.d.ts

@@ -9,6 +9,8 @@ export interface FeedbackSubmitOptions {
     body: string;
     company?: string;
     token: string;
+    /** S3 object keys of already-uploaded screenshots (see uploadScreenshots). */
+    screenshots?: string[];
 }
 export declare function readBodyFile(bodyFile: string, stdin?: NodeJS.ReadableStream): Promise<string>;
 export declare function submitFeedback(opts: FeedbackSubmitOptions): Promise<FeedbackResult>;

package/dist/commands/feedback.js

@@ -1,10 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ee78c7b6-6e93-5217-8a1d-ddc51afcf9c3")}catch(e){}}();
 import * as fs from "node:fs";
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+import { MAX_SCREENSHOTS, uploadScreenshots } from "../utils/feedback-screenshots.js";
 export const BODY_MAX_BYTES = 64 * 1024;
 export async function readBodyFile(bodyFile, stdin) {
     if (bodyFile === "-") {
@@ -25,6 +26,16 @@ export async function readBodyFile(bodyFile, stdin) {
     return fs.promises.readFile(bodyFile, "utf-8");
 }
 export async function submitFeedback(opts) {
+    // Validate the title locally, symmetric with the body check below. Commander's
+    // `requiredOption("--title")` only requires the flag to be PRESENT — an empty
+    // or whitespace-only value (`--title ""`, or a title the /hq-bug skill derived
+    // to nothing) passes the flag check, then the server rejects it with a 400
+    // "title (non-empty string) is required" that floods Sentry as a context-free
+    // warning (HQ-AB). Catch it here so the caller gets a clear, actionable error
+    // and the bad request never reaches the server.
+    if (opts.title.trim().length === 0) {
+        throw new Error("title must not be empty. Provide a short, non-whitespace title via --title.");
+    }
     if (opts.body.trim().length === 0) {
         throw new Error("body must not be empty. Provide at least one non-whitespace character.");
     }
@@ -42,6 +53,9 @@ export async function submitFeedback(opts) {
     if (opts.company) {
         requestBody.company = opts.company;
     }
+    if (opts.screenshots && opts.screenshots.length > 0) {
+        requestBody.screenshots = opts.screenshots;
+    }
     const res = await vaultApiFetch({
         token: opts.token,
         path: "/v1/feedback",
@@ -68,16 +82,24 @@ function registerSubcommand(feedbackCmd, type) {
         .requiredOption("--title <text>", "Short title for the report")
         .requiredOption("--body-file <path>", "Path to a markdown file with the body; use - to read from stdin")
         .option("--company <slug>", "Company slug to associate with the report")
+        .option("--screenshot <path>", `Attach a screenshot (repeatable, up to ${MAX_SCREENSHOTS}; .png/.jpg/.jpeg/.webp/.gif)`, (value, prev) => [...prev, value], [])
         .action(async (opts) => {
         try {
             const token = await ensureCognitoToken({ interactive: false });
             const body = await readBodyFile(opts.bodyFile);
+            // Validate + upload screenshots (direct-to-S3 via presigned PUT)
+            // before submitting, so the row references uploaded objects.
+            const screenshots = await uploadScreenshots({
+                paths: opts.screenshot ?? [],
+                token,
+            });
             const result = await submitFeedback({
                 type,
                 title: opts.title,
                 body,
                 company: opts.company,
                 token,
+                screenshots,
             });
             console.log(`Submitted: ${result.id}`);
         }
@@ -95,4 +117,4 @@ export function registerFeedbackCommand(program) {
     registerSubcommand(feedbackCmd, "feature");
 }
 //# sourceMappingURL=feedback.js.map
-//# debugId=3e8d95ee-bfb4-5ca3-8177-7bc3ca618bd4
+//# debugId=ee78c7b6-6e93-5217-8a1d-ddc51afcf9c3

package/dist/commands/files.d.ts

@@ -68,6 +68,25 @@ interface RunFilesDeleteParams {
     yes: boolean;
     companySlug: string | undefined;
 }
+/**
+ * The vault bucket is already company-scoped, so a delete prefix must be
+ * BUCKET-RELATIVE (e.g. `projects/foo/*`). A caller who pastes an HQ *local*
+ * tree path (`companies/<slug>/projects/foo`) over-prefixes it; the server then
+ * rejects it with INVALID_PREFIX_COMPANIES_SCOPED (HTTP 400), the source of the
+ * recurring Sentry warning HQ-8F. Strip a redundant leading `companies/<slug>/`
+ * so the local-looking path is normalized to the bucket-relative key the vault
+ * actually stores. Returns the stripped slug for a one-line notice, or null when
+ * there was nothing to strip. Pure → unit-testable.
+ *
+ * This runs UPSTREAM of the server's exact-vs-glob branch, so it covers both
+ * the glob spelling (`companies/<slug>/projects/foo/*` → `validatePrefix`,
+ * HQ-8F) and the EXACT-key spelling (`companies/<slug>/notes/foo.md` →
+ * `validateObjectKey`, HQ-CA) with the same normalization.
+ */
+export declare function stripRedundantCompanyScope(prefix: string): {
+    prefix: string;
+    strippedSlug: string;
+} | null;
 export declare function runFilesDelete(params: RunFilesDeleteParams, deps?: {
     confirm?: ConfirmFn;
 }): Promise<void>;

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5f5242f3-b24f-58b0-a3ee-381c42c755fc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6")}catch(e){}}();
 import chalk from "chalk";
 import open from "open";
 import * as readline from "node:readline";
@@ -566,13 +566,47 @@ function printKeyPreview(resp) {
         console.log(chalk.dim(`    … and ${resp.matched - resp.keys.length} more`));
     }
 }
+/**
+ * The vault bucket is already company-scoped, so a delete prefix must be
+ * BUCKET-RELATIVE (e.g. `projects/foo/*`). A caller who pastes an HQ *local*
+ * tree path (`companies/<slug>/projects/foo`) over-prefixes it; the server then
+ * rejects it with INVALID_PREFIX_COMPANIES_SCOPED (HTTP 400), the source of the
+ * recurring Sentry warning HQ-8F. Strip a redundant leading `companies/<slug>/`
+ * so the local-looking path is normalized to the bucket-relative key the vault
+ * actually stores. Returns the stripped slug for a one-line notice, or null when
+ * there was nothing to strip. Pure → unit-testable.
+ *
+ * This runs UPSTREAM of the server's exact-vs-glob branch, so it covers both
+ * the glob spelling (`companies/<slug>/projects/foo/*` → `validatePrefix`,
+ * HQ-8F) and the EXACT-key spelling (`companies/<slug>/notes/foo.md` →
+ * `validateObjectKey`, HQ-CA) with the same normalization.
+ */
+export function stripRedundantCompanyScope(prefix) {
+    const m = /^companies\/([^/]+)(?:\/(.*))?$/.exec(prefix);
+    if (!m)
+        return null;
+    return { prefix: m[2] ?? "", strippedSlug: m[1] };
+}
 export async function runFilesDelete(params, deps = {}) {
     const confirm = deps.confirm ?? realConfirm;
+    // The vault is already company-scoped — a `companies/<slug>/` prefix is the HQ
+    // LOCAL tree layout, not a vault key, and the server 400s it (HQ-8F). Strip it
+    // here so a pasted local path is gracefully normalized to bucket-relative
+    // BEFORE the dry-run/preview (so the operator still sees the exact keys and
+    // confirms the right target). If stripping empties the prefix, the root-reject
+    // below catches it with a clear message.
+    const scope = stripRedundantCompanyScope(params.prefix);
+    if (scope) {
+        console.error(chalk.yellow(`Note: stripped redundant 'companies/${scope.strippedSlug}/' — the vault ` +
+            `is already company-scoped; using bucket-relative ` +
+            `'${scope.prefix || "(root)"}'.`));
+    }
+    const rawPrefix = scope ? scope.prefix : params.prefix;
     // Normalize exactly as the share/unshare/acl paths do (trailing `/` → `/*`),
     // then reject the root/empty prefix CLIENT-side so a typo never reaches the
     // server as a vault-wide delete. The server enforces this too (defense in
     // depth), but failing fast here is clearer and avoids a wasted round-trip.
-    const normalized = normalizeFilePrefix(params.prefix);
+    const normalized = normalizeFilePrefix(rawPrefix);
     if (normalized === "" || normalized === "*" || normalized === "/*") {
         console.error(chalk.red("Refusing to delete the vault root. Pass a bounded prefix (e.g. 'projects/foo/' or 'projects/foo/*') or an exact key."));
         process.exit(1);
@@ -648,4 +682,4 @@ export async function runFilesDelete(params, deps = {}) {
     }
 }
 //# sourceMappingURL=files.js.map
-//# debugId=5f5242f3-b24f-58b0-a3ee-381c42c755fc
+//# debugId=bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6

package/dist/commands/meetings.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e1c09963-744f-5033-9981-1ab6d37956e9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f1986062-db39-5448-a8fa-3bb6be32c58b")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -207,6 +207,54 @@ export function registerMeetingsCommand(program) {
             process.exit(1);
         }
     });
+    // ── hq meetings set-company <id> ──────────────────────────────────
+    meetings
+        .command("set-company <meetingId>")
+        .description("Set or change the company a meeting is attributed to (use 'unknown' to clear)")
+        .option("--company <slug>", "Target company slug, or 'unknown'/'personal' to clear attribution")
+        .option("--no-series", "Apply only to this occurrence, not the whole recurring series")
+        .action(async (rawId, cmdOpts) => {
+        try {
+            const token = await ensureCognitoToken();
+            // `--company` is shared with the parent `meetings` command, so commander
+            // may bind it to either level depending on position — accept both.
+            const target = cmdOpts.company ?? meetings.opts().company;
+            if (!target) {
+                console.error(chalk.red("Error:"), "a target company is required: --company <slug> (or 'unknown'/'personal' to clear)");
+                process.exit(1);
+            }
+            // The bot record is person-keyed, so no company scope is needed to
+            // resolve the meeting id; pass an empty scope.
+            const meetingId = await resolveShortId(token, rawId, {});
+            const lc = target.toLowerCase();
+            const companyId = lc === "unknown" || lc === "personal"
+                ? "unknown"
+                : await getCompanyUid(token, target);
+            const applyToSeries = cmdOpts.series !== false;
+            const res = await vaultApiFetch({
+                token,
+                method: "POST",
+                path: `/v1/meetings/${encodeURIComponent(meetingId)}/company`,
+                body: { companyId, applyToSeries },
+            });
+            if (!res.ok)
+                await handleApiError(res);
+            const data = (await res.json());
+            if (meetings.opts().json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const where = companyId === "unknown" ? "unattributed (personal)" : companyId;
+            console.log(chalk.green(`\n✓ Meeting ${chalk.cyan(meetingId)} attributed to ${chalk.bold(where)}.`));
+            if (data && data.appliedToSeries)
+                console.log(chalk.dim("  Future occurrences of this recurring series will inherit this attribution."));
+            console.log();
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
     // ── hq meetings search <query> ─────────────────────────────────────
     meetings
         .command("search <query>")
@@ -371,4 +419,4 @@ export function registerMeetingsCommand(program) {
     });
 }
 //# sourceMappingURL=meetings.js.map
-//# debugId=e1c09963-744f-5033-9981-1ab6d37956e9
+//# debugId=f1986062-db39-5448-a8fa-3bb6be32c58b

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d01cb1a1-b851-5ffe-9608-e505e55dcdc8")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3049e431-c5db-5430-90fe-82866c35e95b")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -251,6 +251,11 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
         if (!res.ok) {
             const body = (await res.json().catch(() => ({})));
             const message = extractApiMessage(body, res.statusText);
+            // High-security ("nuclear") refusal surfaced at the batch level (rather
+            // than per-name): point the caller at the proxy and never leak plaintext.
+            if (body.code === "high_security_denied" || body.highSecurity === true) {
+                throw new Error("A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.");
+            }
             if (res.status >= 400 &&
                 res.status < 500 &&
                 typeof body.code === "string") {
@@ -280,6 +285,15 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
             if (resolved.has(key))
                 continue;
             const err = errorsByName.get(key);
+            // High-security ("nuclear") secret: the server refuses to vend it on the
+            // local-injection (batch-load) path — per-name code `high_security_denied`,
+            // no plaintext returned. Every caller of loadRevealedSecrets injects or
+            // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
+            // `secrets env`), so a high-security secret can NEVER be used here. Surface
+            // a clear, actionable error pointing at the proxy instead of a raw failure.
+            if (err?.code === "high_security_denied") {
+                throw new Error(`Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`);
+            }
             const reason = err?.code === "not_found"
                 ? "Secret not found"
                 : err?.code === "forbidden"
@@ -364,6 +378,15 @@ export function registerSecretsCommand(program) {
             });
             if (!res.ok) {
                 const body = (await res.json().catch(() => ({})));
+                // High-security ("nuclear") secret: the server refuses to reveal it on
+                // the local-injection path (403, no plaintext). Surface a clear,
+                // actionable error pointing the user at the proxy rather than a raw
+                // 4xx — the value can ONLY be used through the server-side proxy.
+                if (res.status === 403 && body.highSecurity === true) {
+                    console.error(chalk.red(`Secret '${name}' is high-security and cannot be revealed locally.`));
+                    console.error(chalk.dim("  It can only be used through the HQ secret proxy, which keeps the plaintext server-side."));
+                    process.exit(1);
+                }
                 console.error(chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
@@ -1125,4 +1148,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=d01cb1a1-b851-5ffe-9608-e505e55dcdc8
+//# debugId=3049e431-c5db-5430-90fe-82866c35e95b

package/dist/run/hq-plugin.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="63aeb21a-b1e7-5bff-8c7d-560fad3cc0dd")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="20ece834-f9b5-5295-8620-87eb4f13ba7c")}catch(e){}}();
 import { ResolutionError } from 'varlock/plugin-lib';
 import { DEFAULT_SECRETS_CACHE_TTL_MS, readCache, writeCache, } from '../utils/secrets-cache.js';
 function normalizeCacheTtlMs(cacheTtlMs) {
@@ -59,6 +59,13 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
                     if (err.code === 'not_found') {
                         throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
                     }
+                    // High-security ("nuclear") secret: the server refuses to vend it on
+                    // the local-injection path. It can ONLY be used through the
+                    // server-side proxy, so `hq run` (which injects plaintext into the
+                    // child env) can never load it. Surface a clear, actionable error.
+                    if (err.code === 'high_security_denied') {
+                        throw new ResolutionError(`Secret "${secretName}" is high-security and cannot be injected locally — it can only be used via the HQ secret proxy (POST /secrets/{companyUid}/proxy/{path}), which keeps the plaintext server-side. Remove it from this schema's locally-injected vars.`);
+                    }
                     throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
                 }
                 // Sentinel-check style throughout: `readCache` returns `string | null`
@@ -158,4 +165,4 @@ export async function prewarmHqSecrets(graph /* EnvGraph */, opts, state) {
     state.uid = uid;
 }
 //# sourceMappingURL=hq-plugin.js.map
-//# debugId=63aeb21a-b1e7-5bff-8c7d-560fad3cc0dd
+//# debugId=20ece834-f9b5-5295-8620-87eb4f13ba7c

package/dist/sentry-dsn.generated.d.ts

@@ -1,2 +1,2 @@
-export declare const BUNDLED_DSN = "https://ed8c1f7624b67945b43d485bbf98d0f7@o4507292345892864.ingest.us.sentry.io/4511263744786432";
+export declare const BUNDLED_DSN = "https://467061dc39fb64644f5640a82d8949cf@o4507292345892864.ingest.us.sentry.io/4511597516226560";
 //# sourceMappingURL=sentry-dsn.generated.d.ts.map

package/dist/sentry-dsn.generated.js

@@ -1,5 +1,5 @@
 
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="55f2362e-5cf7-5dac-b6a3-ef0f9ccde645")}catch(e){}}();
-export const BUNDLED_DSN = "https://ed8c1f7624b67945b43d485bbf98d0f7@o4507292345892864.ingest.us.sentry.io/4511263744786432";
+export const BUNDLED_DSN = "https://467061dc39fb64644f5640a82d8949cf@o4507292345892864.ingest.us.sentry.io/4511597516226560";
 //# sourceMappingURL=sentry-dsn.generated.js.map
 //# debugId=55f2362e-5cf7-5dac-b6a3-ef0f9ccde645

package/dist/sentry.js

@@ -1,16 +1,20 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="508ac88d-5683-5d1f-9857-80a8a74e03e2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="80ca2b2d-c649-5e88-9bc6-69a20fa4aa51")}catch(e){}}();
 import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
 import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
+import { CLI_VERSION } from "./cli-version.js";
 export function initSentry() {
     const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
     if (!dsn)
         return;
     Sentry.init({
         dsn,
-        release: `hq-cli@${process.env.npm_package_version ?? "0.0.0"}`,
+        // CLI_VERSION reads package.json at runtime; npm_package_version is only
+        // set under `npm run`, so an installed `hq` binary would always report
+        // 0.0.0 and never match the uploaded source maps.
+        release: `hq-cli@${CLI_VERSION}`,
         environment: process.env.HQ_CLI_ENV ?? "production",
         initialScope: {
             tags: { repo: "hq-cli" },
@@ -21,4 +25,4 @@ export function initSentry() {
 }
 export { Sentry };
 //# sourceMappingURL=sentry.js.map
-//# debugId=508ac88d-5683-5d1f-9857-80a8a74e03e2
+//# debugId=80ca2b2d-c649-5e88-9bc6-69a20fa4aa51

package/dist/utils/feedback-diagnostics.d.ts

@@ -1,3 +1,4 @@
+import { type VersionInfo } from "./feedback-versions.js";
 export interface GitContext {
     branch: string | null;
     head: string | null;
@@ -6,6 +7,12 @@ export interface GitContext {
 }
 export interface DiagnosticsBlob {
     cliVersion: string;
+    /**
+     * The hq-cli, hq-core, and hq-sync versions from the submitter's
+     * environment. `cliVersion` above is retained for back-compat; new
+     * consumers should read `versions` (which carries core + sync too).
+     */
+    versions: VersionInfo;
     nodeVersion: string;
     os: {
         platform: string;

package/dist/utils/feedback-diagnostics.js

@@ -1,9 +1,10 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ee39c63b-ddaa-553d-b5db-77633d323d88")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ae4c924b-fe3d-558c-8b44-e1bac1f5a73e")}catch(e){}}();
 import * as os from "os";
 import { execFileSync } from "child_process";
 import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
+import { collectVersions } from "./feedback-versions.js";
 const SECRET_FLAGS = new Set([
     "--token",
     "--secret",
@@ -79,6 +80,7 @@ function collectGitContext() {
 export function collectDiagnostics() {
     return {
         cliVersion: CLI_VERSION,
+        versions: collectVersions(),
         nodeVersion: process.version,
         os: {
             platform: os.platform(),
@@ -92,4 +94,4 @@ export function collectDiagnostics() {
     };
 }
 //# sourceMappingURL=feedback-diagnostics.js.map
-//# debugId=ee39c63b-ddaa-553d-b5db-77633d323d88
+//# debugId=ae4c924b-fe3d-558c-8b44-e1bac1f5a73e

package/dist/utils/feedback-screenshots.d.ts

@@ -0,0 +1,23 @@
+export declare const MAX_SCREENSHOTS = 5;
+export declare const MAX_SCREENSHOT_BYTES: number;
+export declare function contentTypeForPath(filePath: string): string;
+export interface ScreenshotInput {
+    path: string;
+    contentType: string;
+    bytes: Buffer;
+}
+/** Validate + read the given screenshot paths (count, type, existence, size). */
+export declare function loadScreenshots(paths: string[]): ScreenshotInput[];
+/**
+ * Validate the screenshot paths, request presigned PUT URLs from the feedback
+ * endpoint, upload each image direct to S3, and return the object keys to
+ * attach to the feedback submission. Returns [] for no screenshots.
+ *
+ * `fetchImpl` is injectable for tests; defaults to the global fetch.
+ */
+export declare function uploadScreenshots(opts: {
+    paths: string[];
+    token: string;
+    fetchImpl?: typeof fetch;
+}): Promise<string[]>;
+//# sourceMappingURL=feedback-screenshots.d.ts.map