@indigoai-us/hq-cli 5.47.16 → 5.48.0

package/dist/utils/feedback-screenshots.js

@@ -0,0 +1,98 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="13f46978-c3c8-532d-b0bb-e8febf876587")}catch(e){}}();
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { vaultApiFetch } from "./vault-api.js";
+export const MAX_SCREENSHOTS = 5;
+// Per-image ceiling. Screenshots are PNG/JPEG captures; 10 MB is generous.
+export const MAX_SCREENSHOT_BYTES = 10 * 1024 * 1024;
+// Extension → content type. Must stay in sync with the server's allowed set
+// (hq-pro feedback-screenshots.ts ALLOWED_CONTENT_TYPES).
+const EXT_CONTENT_TYPE = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+};
+export function contentTypeForPath(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const contentType = EXT_CONTENT_TYPE[ext];
+    if (!contentType) {
+        throw new Error(`unsupported screenshot type: ${filePath} (allowed: ${Object.keys(EXT_CONTENT_TYPE).join(", ")})`);
+    }
+    return contentType;
+}
+/** Validate + read the given screenshot paths (count, type, existence, size). */
+export function loadScreenshots(paths) {
+    if (paths.length > MAX_SCREENSHOTS) {
+        throw new Error(`at most ${MAX_SCREENSHOTS} screenshots are allowed (got ${paths.length})`);
+    }
+    return paths.map((filePath) => {
+        const contentType = contentTypeForPath(filePath);
+        let bytes;
+        try {
+            bytes = fs.readFileSync(filePath);
+        }
+        catch {
+            throw new Error(`cannot read screenshot: ${filePath}`);
+        }
+        if (bytes.byteLength === 0) {
+            throw new Error(`screenshot is empty: ${filePath}`);
+        }
+        if (bytes.byteLength > MAX_SCREENSHOT_BYTES) {
+            throw new Error(`screenshot too large: ${filePath} (${bytes.byteLength} bytes, max ${MAX_SCREENSHOT_BYTES})`);
+        }
+        return { path: filePath, contentType, bytes };
+    });
+}
+/**
+ * Validate the screenshot paths, request presigned PUT URLs from the feedback
+ * endpoint, upload each image direct to S3, and return the object keys to
+ * attach to the feedback submission. Returns [] for no screenshots.
+ *
+ * `fetchImpl` is injectable for tests; defaults to the global fetch.
+ */
+export async function uploadScreenshots(opts) {
+    if (opts.paths.length === 0)
+        return [];
+    const inputs = loadScreenshots(opts.paths);
+    const res = await vaultApiFetch({
+        token: opts.token,
+        path: "/v1/feedback/screenshots/presign",
+        method: "POST",
+        body: { contentTypes: inputs.map((i) => i.contentType) },
+    });
+    if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        const msg = data &&
+            typeof data === "object" &&
+            typeof data.error === "string"
+            ? data.error
+            : res.statusText;
+        throw new Error(`Failed to presign screenshots: ${msg}`);
+    }
+    const parsed = (await res.json());
+    if (!parsed ||
+        !Array.isArray(parsed.screenshots) ||
+        parsed.screenshots.length !== inputs.length) {
+        throw new Error("Presign response did not match the requested screenshots");
+    }
+    const doFetch = opts.fetchImpl ?? fetch;
+    const keys = [];
+    for (let i = 0; i < inputs.length; i++) {
+        const slot = parsed.screenshots[i];
+        const put = await doFetch(slot.url, {
+            method: "PUT",
+            headers: { "Content-Type": slot.contentType },
+            body: inputs[i].bytes,
+        });
+        if (!put.ok) {
+            throw new Error(`Failed to upload screenshot ${inputs[i].path}: HTTP ${put.status}`);
+        }
+        keys.push(slot.key);
+    }
+    return keys;
+}
+//# sourceMappingURL=feedback-screenshots.js.map
+//# debugId=13f46978-c3c8-532d-b0bb-e8febf876587

package/dist/utils/feedback-versions.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The three HQ component versions captured from the submitter's environment
+ * and attached to a feedback submission so triage can see exactly which
+ * versions a report came from.
+ *
+ *   - `cli`  — this hq-cli build (always known).
+ *   - `core` — the HQ scaffold version from `core/core.yaml` (`hqVersion`);
+ *               null when the command runs outside an HQ tree.
+ *   - `sync` — the installed hq-sync menubar app version, which the app
+ *               records at `~/.hq/sync-version.json` on startup; null when
+ *               hq-sync is not installed (e.g. CLI-only / CI environments).
+ */
+export interface VersionInfo {
+    cli: string;
+    core: string | null;
+    sync: string | null;
+}
+/**
+ * Best-effort read of the hq-core scaffold version (`core/core.yaml`
+ * `hqVersion`). Resolves the HQ root from the working directory; returns
+ * null when no HQ root / core.yaml is found rather than throwing — version
+ * capture must never break a feedback submission.
+ */
+export declare function readCoreVersion(): string | null;
+/**
+ * Best-effort read of the hq-sync menubar app version. The app writes
+ * `{ version, updatedAt }` to `~/.hq/sync-version.json` on startup; the CLI
+ * reads it here. Returns null when the file is absent or malformed (hq-sync
+ * not installed, or an older build that predates the marker).
+ */
+export declare function readSyncVersion(homeDir?: string): string | null;
+/** Collect all three component versions, each independently best-effort. */
+export declare function collectVersions(): VersionInfo;
+//# sourceMappingURL=feedback-versions.d.ts.map

package/dist/utils/feedback-versions.js

@@ -0,0 +1,50 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ea3328d1-5c42-5d60-ad24-f96c11a37f22")}catch(e){}}();
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { CLI_VERSION } from "../cli-version.js";
+import { findHqRoot } from "./manifest.js";
+import { readHqVersion } from "./pack-contributions.js";
+/**
+ * Best-effort read of the hq-core scaffold version (`core/core.yaml`
+ * `hqVersion`). Resolves the HQ root from the working directory; returns
+ * null when no HQ root / core.yaml is found rather than throwing — version
+ * capture must never break a feedback submission.
+ */
+export function readCoreVersion() {
+    try {
+        return readHqVersion(findHqRoot());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Best-effort read of the hq-sync menubar app version. The app writes
+ * `{ version, updatedAt }` to `~/.hq/sync-version.json` on startup; the CLI
+ * reads it here. Returns null when the file is absent or malformed (hq-sync
+ * not installed, or an older build that predates the marker).
+ */
+export function readSyncVersion(homeDir = os.homedir()) {
+    try {
+        const raw = fs.readFileSync(path.join(homeDir, ".hq", "sync-version.json"), "utf-8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed.version === "string" && parsed.version.length > 0
+            ? parsed.version
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Collect all three component versions, each independently best-effort. */
+export function collectVersions() {
+    return {
+        cli: CLI_VERSION,
+        core: readCoreVersion(),
+        sync: readSyncVersion(),
+    };
+}
+//# sourceMappingURL=feedback-versions.js.map
+//# debugId=ea3328d1-5c42-5d60-ad24-f96c11a37f22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.16",
+  "version": "5.48.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -11,11 +11,12 @@
     "build": "node scripts/generate-dsn.mjs && tsc",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
     "vitest": "vitest",
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "^6.11.7",
+    "@indigoai-us/hq-cloud": "^6.11.14",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",
@@ -31,6 +32,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "@types/semver": "^7.5.8",
+    "@vitest/coverage-v8": "4.1.6",
     "typescript": "^5.7.0",
     "vitest": "^4.1.2"
   },

package/src/commands/feedback.test.ts

@@ -156,6 +156,24 @@ describe("submitFeedback", () => {
     expect((call.body as Record<string, unknown>)).not.toHaveProperty("company");
   });
 
+  it("includes screenshot keys when provided, omits the key otherwise", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(jsonResponse(200, { id: "feedback_s1" }));
+    await submitFeedback({
+      type: "bug",
+      title: "With shots",
+      body: "Details",
+      token: "tok",
+      screenshots: ["feedback-screenshots/prs_a/sub/0.png"],
+    });
+    expect((mockVaultApiFetch.mock.calls[0][0].body as Record<string, unknown>).screenshots).toEqual([
+      "feedback-screenshots/prs_a/sub/0.png",
+    ]);
+
+    mockVaultApiFetch.mockResolvedValueOnce(jsonResponse(200, { id: "feedback_s2" }));
+    await submitFeedback({ type: "bug", title: "No shots", body: "Details", token: "tok", screenshots: [] });
+    expect(mockVaultApiFetch.mock.calls[1][0].body).not.toHaveProperty("screenshots");
+  });
+
   it("attaches diagnostics from collectDiagnostics to the request body", async () => {
     mockVaultApiFetch.mockResolvedValueOnce(
       jsonResponse(200, { id: "feedback_diag" }),
@@ -249,6 +267,32 @@ describe("submitFeedback", () => {
 
     expect(mockVaultApiFetch).not.toHaveBeenCalled();
   });
+
+  // HQ-AB: an empty/whitespace title (e.g. `--title ""`, or a title the /hq-bug
+  // skill derived to nothing) used to slip past Commander's required-flag check
+  // and 400 server-side, flooding Sentry with a context-free warning. The local
+  // guard now rejects it before any network call.
+  it("throws before fetching when title is empty or whitespace-only", async () => {
+    await expect(
+      submitFeedback({
+        type: "bug",
+        title: "   \n\t  ",
+        body: "Real body",
+        token: "tok",
+      }),
+    ).rejects.toThrow(/title must not be empty/);
+
+    await expect(
+      submitFeedback({
+        type: "feature",
+        title: "",
+        body: "Real body",
+        token: "tok",
+      }),
+    ).rejects.toThrow(/title must not be empty/);
+
+    expect(mockVaultApiFetch).not.toHaveBeenCalled();
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/commands/feedback.ts

@@ -4,6 +4,7 @@ import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+import { MAX_SCREENSHOTS, uploadScreenshots } from "../utils/feedback-screenshots.js";
 
 export const BODY_MAX_BYTES = 64 * 1024;
 
@@ -17,6 +18,8 @@ export interface FeedbackSubmitOptions {
   body: string;
   company?: string;
   token: string;
+  /** S3 object keys of already-uploaded screenshots (see uploadScreenshots). */
+  screenshots?: string[];
 }
 
 export async function readBodyFile(
@@ -46,6 +49,19 @@ export async function readBodyFile(
 export async function submitFeedback(
   opts: FeedbackSubmitOptions,
 ): Promise<FeedbackResult> {
+  // Validate the title locally, symmetric with the body check below. Commander's
+  // `requiredOption("--title")` only requires the flag to be PRESENT — an empty
+  // or whitespace-only value (`--title ""`, or a title the /hq-bug skill derived
+  // to nothing) passes the flag check, then the server rejects it with a 400
+  // "title (non-empty string) is required" that floods Sentry as a context-free
+  // warning (HQ-AB). Catch it here so the caller gets a clear, actionable error
+  // and the bad request never reaches the server.
+  if (opts.title.trim().length === 0) {
+    throw new Error(
+      "title must not be empty. Provide a short, non-whitespace title via --title.",
+    );
+  }
+
   if (opts.body.trim().length === 0) {
     throw new Error(
       "body must not be empty. Provide at least one non-whitespace character.",
@@ -70,6 +86,9 @@ export async function submitFeedback(
   if (opts.company) {
     requestBody.company = opts.company;
   }
+  if (opts.screenshots && opts.screenshots.length > 0) {
+    requestBody.screenshots = opts.screenshots;
+  }
 
   const res = await vaultApiFetch({
     token: opts.token,
@@ -104,19 +123,33 @@ function registerSubcommand(feedbackCmd: Command, type: "bug" | "feature"): void
       "Path to a markdown file with the body; use - to read from stdin",
     )
     .option("--company <slug>", "Company slug to associate with the report")
-    .action(async (opts: { title: string; bodyFile: string; company?: string }) => {
-      try {
-        const token = await ensureCognitoToken({ interactive: false });
-        const body = await readBodyFile(opts.bodyFile);
-        const result = await submitFeedback({
-          type,
-          title: opts.title,
-          body,
-          company: opts.company,
-          token,
-        });
-        console.log(`Submitted: ${result.id}`);
-      } catch (err) {
+    .option(
+      "--screenshot <path>",
+      `Attach a screenshot (repeatable, up to ${MAX_SCREENSHOTS}; .png/.jpg/.jpeg/.webp/.gif)`,
+      (value: string, prev: string[]) => [...prev, value],
+      [] as string[],
+    )
+    .action(
+      async (opts: { title: string; bodyFile: string; company?: string; screenshot: string[] }) => {
+        try {
+          const token = await ensureCognitoToken({ interactive: false });
+          const body = await readBodyFile(opts.bodyFile);
+          // Validate + upload screenshots (direct-to-S3 via presigned PUT)
+          // before submitting, so the row references uploaded objects.
+          const screenshots = await uploadScreenshots({
+            paths: opts.screenshot ?? [],
+            token,
+          });
+          const result = await submitFeedback({
+            type,
+            title: opts.title,
+            body,
+            company: opts.company,
+            token,
+            screenshots,
+          });
+          console.log(`Submitted: ${result.id}`);
+        } catch (err) {
         console.error(
           chalk.red("Error:"),
           err instanceof Error ? err.message : String(err),

package/src/commands/files-delete.test.ts

@@ -38,6 +38,7 @@ import { Command } from "commander";
 import {
   registerFilesCommand,
   runFilesDelete,
+  stripRedundantCompanyScope,
   FilesDeleteHttpError,
   formatFilesDeleteError,
   type FilesDeleteResponse,
@@ -242,6 +243,137 @@ describe("hq files delete — root/empty prefix rejected client-side", () => {
   }
 });
 
+// HQ-8F: a caller who pastes an HQ *local* tree path (`companies/<slug>/…`)
+// over-prefixes the bucket-relative vault key; the server rejects it with a 400
+// (INVALID_PREFIX_COMPANIES_SCOPED), the source of the recurring warning. The
+// CLI now strips the redundant scope BEFORE sending, so the local-looking path
+// is gracefully normalized to bucket-relative.
+describe("stripRedundantCompanyScope (HQ-8F, pure)", () => {
+  it("strips a leading companies/<slug>/ to the bucket-relative remainder", () => {
+    expect(stripRedundantCompanyScope("companies/acme/projects/foo")).toEqual({
+      prefix: "projects/foo",
+      strippedSlug: "acme",
+    });
+    expect(stripRedundantCompanyScope("companies/acme/projects/foo/*")).toEqual({
+      prefix: "projects/foo/*",
+      strippedSlug: "acme",
+    });
+  });
+
+  it("returns an EMPTY remainder for the company-root spellings (→ root-reject)", () => {
+    expect(stripRedundantCompanyScope("companies/acme")).toEqual({
+      prefix: "",
+      strippedSlug: "acme",
+    });
+    expect(stripRedundantCompanyScope("companies/acme/")).toEqual({
+      prefix: "",
+      strippedSlug: "acme",
+    });
+  });
+
+  it("leaves an already bucket-relative prefix untouched (null)", () => {
+    expect(stripRedundantCompanyScope("projects/foo/*")).toBeNull();
+    expect(stripRedundantCompanyScope("reports/q3/")).toBeNull();
+    // A non-scope path that merely starts with the word "companies" is NOT a
+    // scope prefix and must be left alone.
+    expect(stripRedundantCompanyScope("companiesreport/x")).toBeNull();
+  });
+});
+
+describe("hq files delete — HQ-8F company-scope normalization", () => {
+  it("strips companies/<slug>/ and sends the BUCKET-RELATIVE prefix (no 400)", async () => {
+    fetchSpy.mockResolvedValueOnce(membershipResponse());
+    fetchSpy.mockResolvedValueOnce(
+      deleteResponse({ dryRun: true, matched: 1, keys: ["projects/foo/a.md"] }),
+    );
+    fetchSpy.mockResolvedValueOnce(
+      deleteResponse({ matched: 1, deleted: 1, tombstoned: 1, keys: ["projects/foo/a.md"] }),
+    );
+
+    await runFilesDelete(
+      {
+        // Trailing slash → also exercises the `/` → `/*` glob normalization.
+        prefix: "companies/acme/projects/foo/",
+        dryRun: false,
+        yes: true,
+        companySlug: undefined,
+      },
+      { confirm: async () => true },
+    );
+
+    const bodies = deleteCallBodies();
+    // Both the preview and the delete carry the stripped, bucket-relative prefix.
+    expect(bodies.map((b) => b.prefix)).toEqual(["projects/foo/*", "projects/foo/*"]);
+    expect(printedErr()).toContain("stripped redundant 'companies/acme/'");
+  });
+
+  it("a bare companies/<slug> strips to empty → root-reject, no network call", async () => {
+    const program = buildProgram();
+    await expect(
+      program.parseAsync(["files", "delete", "companies/acme", "--yes"], {
+        from: "user",
+      }),
+    ).rejects.toThrow(/__EXIT__:1/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(printedErr()).toContain("Refusing to delete the vault root");
+  });
+});
+
+// HQ-CA: the EXACT-KEY sibling of HQ-8F. When the over-prefixed path has no
+// trailing slash and no wildcard (a literal key like
+// `companies/<slug>/notes/foo.md`), the server takes the exact-key branch where
+// `validateObjectKey` — not `validatePrefix` — rejects it with a 400 ("Invalid
+// key: … do not prefix with 'companies/<slug>/'."). The same client-side strip
+// runs UPSTREAM of the server's exact-vs-glob split, so it normalizes the exact
+// key to bucket-relative and the 400 is never emitted. This locks that path,
+// which #117 only exercised via the trailing-slash (glob) spelling.
+describe("hq files delete — HQ-CA exact-key company-scope normalization", () => {
+  it("strips companies/<slug>/ from an EXACT key and sends the bucket-relative key (no glob, no 400)", async () => {
+    fetchSpy.mockResolvedValueOnce(membershipResponse());
+    fetchSpy.mockResolvedValueOnce(
+      deleteResponse({
+        dryRun: true,
+        mode: "exact",
+        prefix: "notes/foo.md",
+        matched: 1,
+        keys: ["notes/foo.md"],
+      }),
+    );
+    fetchSpy.mockResolvedValueOnce(
+      deleteResponse({
+        mode: "exact",
+        prefix: "notes/foo.md",
+        matched: 1,
+        deleted: 1,
+        tombstoned: 1,
+        keys: ["notes/foo.md"],
+      }),
+    );
+
+    await runFilesDelete(
+      {
+        // No trailing slash, no wildcard → server takes the EXACT-key branch.
+        prefix: "companies/acme/notes/foo.md",
+        dryRun: false,
+        yes: true,
+        companySlug: undefined,
+      },
+      { confirm: async () => true },
+    );
+
+    const bodies = deleteCallBodies();
+    // Preview + delete both carry the stripped, bucket-relative EXACT key —
+    // never the `companies/acme/...` over-prefix that 400s, and never glob-ified
+    // into a prefix delete.
+    expect(bodies.map((b) => b.prefix)).toEqual(["notes/foo.md", "notes/foo.md"]);
+    for (const b of bodies) {
+      expect(b.prefix.startsWith("companies/")).toBe(false);
+      expect(b.prefix).not.toContain("*");
+    }
+    expect(printedErr()).toContain("stripped redundant 'companies/acme/'");
+  });
+});
+
 describe("hq files delete — server error mapping", () => {
   it("403 surfaces a clear not-authorized message and exits 1", async () => {
     fetchSpy.mockResolvedValueOnce(membershipResponse());

package/src/commands/files.ts

@@ -782,17 +782,58 @@ function printKeyPreview(resp: FilesDeleteResponse): void {
   }
 }
 
+/**
+ * The vault bucket is already company-scoped, so a delete prefix must be
+ * BUCKET-RELATIVE (e.g. `projects/foo/*`). A caller who pastes an HQ *local*
+ * tree path (`companies/<slug>/projects/foo`) over-prefixes it; the server then
+ * rejects it with INVALID_PREFIX_COMPANIES_SCOPED (HTTP 400), the source of the
+ * recurring Sentry warning HQ-8F. Strip a redundant leading `companies/<slug>/`
+ * so the local-looking path is normalized to the bucket-relative key the vault
+ * actually stores. Returns the stripped slug for a one-line notice, or null when
+ * there was nothing to strip. Pure → unit-testable.
+ *
+ * This runs UPSTREAM of the server's exact-vs-glob branch, so it covers both
+ * the glob spelling (`companies/<slug>/projects/foo/*` → `validatePrefix`,
+ * HQ-8F) and the EXACT-key spelling (`companies/<slug>/notes/foo.md` →
+ * `validateObjectKey`, HQ-CA) with the same normalization.
+ */
+export function stripRedundantCompanyScope(
+  prefix: string,
+): { prefix: string; strippedSlug: string } | null {
+  const m = /^companies\/([^/]+)(?:\/(.*))?$/.exec(prefix);
+  if (!m) return null;
+  return { prefix: m[2] ?? "", strippedSlug: m[1] };
+}
+
 export async function runFilesDelete(
   params: RunFilesDeleteParams,
   deps: { confirm?: ConfirmFn } = {},
 ): Promise<void> {
   const confirm = deps.confirm ?? realConfirm;
 
+  // The vault is already company-scoped — a `companies/<slug>/` prefix is the HQ
+  // LOCAL tree layout, not a vault key, and the server 400s it (HQ-8F). Strip it
+  // here so a pasted local path is gracefully normalized to bucket-relative
+  // BEFORE the dry-run/preview (so the operator still sees the exact keys and
+  // confirms the right target). If stripping empties the prefix, the root-reject
+  // below catches it with a clear message.
+  const scope = stripRedundantCompanyScope(params.prefix);
+  if (scope) {
+    console.error(
+      chalk.yellow(
+        `Note: stripped redundant 'companies/${scope.strippedSlug}/' — the vault ` +
+          `is already company-scoped; using bucket-relative ` +
+          `'${scope.prefix || "(root)"}'.`,
+      ),
+    );
+  }
+  const rawPrefix = scope ? scope.prefix : params.prefix;
+
   // Normalize exactly as the share/unshare/acl paths do (trailing `/` → `/*`),
   // then reject the root/empty prefix CLIENT-side so a typo never reaches the
   // server as a vault-wide delete. The server enforces this too (defense in
   // depth), but failing fast here is clearer and avoids a wasted round-trip.
-  const normalized = normalizeFilePrefix(params.prefix);
+  const normalized = normalizeFilePrefix(rawPrefix);
   if (normalized === "" || normalized === "*" || normalized === "/*") {
     console.error(
       chalk.red(