@indigoai-us/hq-cli 5.47.16 → 5.48.0

package/src/commands/meetings.test.ts

@@ -0,0 +1,163 @@
+import { Command } from "commander";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = (await importOriginal()) as Record<string, unknown>;
+  return {
+    ...original,
+    getCompanyUid: vi.fn(async (_token: string, slug: string) => `cmp_${slug}`),
+    vaultApiFetch: vi.fn(async () =>
+      new Response(JSON.stringify({ appliedToSeries: true }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }),
+    ),
+  };
+});
+
+import { registerMeetingsCommand } from "./meetings.js";
+import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
+
+let logSpy: MockInstance<typeof console.log>;
+let errSpy: MockInstance<typeof console.error>;
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+  errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.exitOverride();
+  program.configureOutput({
+    writeOut: () => undefined,
+    writeErr: () => undefined,
+  });
+  registerMeetingsCommand(program);
+  return program;
+}
+
+function jsonRes(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+describe("meetings set-company", () => {
+  it("POSTs the resolved company id and applies to the recurring series by default", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: true }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+    ]);
+
+    expect(getCompanyUid).toHaveBeenCalledWith("test-token", "acme");
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "cmp_acme", applyToSeries: true },
+    });
+    expect(errSpy).not.toHaveBeenCalled();
+  });
+
+  it("sends unknown without resolving a target company", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: true }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "unknown",
+    ]);
+
+    expect(getCompanyUid).not.toHaveBeenCalled();
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "unknown", applyToSeries: true },
+    });
+  });
+
+  it("sends applyToSeries false when --no-series is passed", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({ appliedToSeries: false }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+      "--no-series",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      method: "POST",
+      path: "/v1/meetings/meeting-123456/company",
+      body: { companyId: "cmp_acme", applyToSeries: false },
+    });
+  });
+
+  it("prints the raw response when --json is passed", async () => {
+    const body = { meetingId: "meeting-123456", companyId: "cmp_acme" };
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes(body));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "meetings",
+      "--json",
+      "set-company",
+      "meeting-123456",
+      "--company",
+      "acme",
+    ]);
+
+    expect(logSpy).toHaveBeenCalledWith(JSON.stringify(body, null, 2));
+  });
+});

package/src/commands/meetings.ts

@@ -299,6 +299,66 @@ export function registerMeetingsCommand(program: Command): void {
       }
     });
 
+  // ── hq meetings set-company <id> ──────────────────────────────────
+
+  meetings
+    .command("set-company <meetingId>")
+    .description("Set or change the company a meeting is attributed to (use 'unknown' to clear)")
+    .option("--company <slug>", "Target company slug, or 'unknown'/'personal' to clear attribution")
+    .option("--no-series", "Apply only to this occurrence, not the whole recurring series")
+    .action(async (rawId: string, cmdOpts: { company?: string; series?: boolean }) => {
+      try {
+        const token = await ensureCognitoToken();
+        // `--company` is shared with the parent `meetings` command, so commander
+        // may bind it to either level depending on position — accept both.
+        const target = cmdOpts.company ?? (meetings.opts().company as string | undefined);
+        if (!target) {
+          console.error(
+            chalk.red("Error:"),
+            "a target company is required: --company <slug> (or 'unknown'/'personal' to clear)",
+          );
+          process.exit(1);
+        }
+
+        // The bot record is person-keyed, so no company scope is needed to
+        // resolve the meeting id; pass an empty scope.
+        const meetingId = await resolveShortId(token, rawId, {});
+
+        const lc = target.toLowerCase();
+        const companyId =
+          lc === "unknown" || lc === "personal"
+            ? "unknown"
+            : await getCompanyUid(token, target);
+
+        const applyToSeries = cmdOpts.series !== false;
+
+        const res = await vaultApiFetch({
+          token,
+          method: "POST",
+          path: `/v1/meetings/${encodeURIComponent(meetingId)}/company`,
+          body: { companyId, applyToSeries },
+        });
+        if (!res.ok) await handleApiError(res);
+        const data = (await res.json()) as {
+          appliedToSeries?: boolean;
+          [key: string]: unknown;
+        };
+
+        if (meetings.opts().json) {
+          console.log(JSON.stringify(data, null, 2));
+          return;
+        }
+
+        const where = companyId === "unknown" ? "unattributed (personal)" : companyId;
+        console.log(chalk.green(`\n✓ Meeting ${chalk.cyan(meetingId)} attributed to ${chalk.bold(where)}.`));
+        if (data && data.appliedToSeries) console.log(chalk.dim("  Future occurrences of this recurring series will inherit this attribution."));
+        console.log();
+      } catch (err) {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    });
+
   // ── hq meetings search <query> ─────────────────────────────────────
 
   meetings

package/src/commands/secrets.test.ts

@@ -160,6 +160,86 @@ describe("secrets exists (HQ-4H HEAD probe)", () => {
   });
 });
 
+// US-003 (secrets-server-proxy): the CLI surfaces the SERVER's refusal of a
+// high-security ("nuclear") secret on the local-injection path as a clear,
+// actionable error pointing at the proxy — and never prints the value. The
+// server-side deny is the real control (it returns 403 + highSecurity:true and
+// NO plaintext); these tests assert the CLI's surfacing behavior.
+describe("US-003 — CLI refuses high-security secrets on local injection", () => {
+  // The server's 403 refusal shape for a high-security secret.
+  function highSecurityDenied(): Response {
+    return new Response(
+      JSON.stringify({
+        error:
+          "Secret 'ANTHROPIC_API_KEY' is high-security and cannot be retrieved via local injection. Use the server-side proxy.",
+        highSecurity: true,
+      }),
+      { status: 403, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  let exitSpy: MockInstance<typeof process.exit>;
+  beforeEach(() => {
+    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("__exit__");
+    }) as never);
+  });
+
+  it("E2E: `secrets get --reveal` is denied — clear proxy-pointing error, no value printed", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(highSecurityDenied());
+
+    const program = buildProgram();
+    try {
+      await program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "get",
+        "ANTHROPIC_API_KEY",
+        "--reveal",
+      ]);
+    } catch {
+      // exit sentinel
+    }
+    const exitCode = exitSpy.mock.calls[0]?.[0] as number | undefined;
+
+    expect(exitCode).toBe(1);
+    // A clear, actionable error mentioning high-security + the proxy.
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/high-security/i);
+    expect(errText).toMatch(/proxy/i);
+    // The value is NEVER printed — no "Value:" line carrying plaintext.
+    const logText = logSpy.mock.calls.flat().join(" ");
+    expect(logText).not.toMatch(/sk-ant/i);
+  });
+
+  it("E2E: `secrets exec --only <name> -- env` is denied — proxy-pointing error, command not run", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(highSecurityDenied());
+
+    const program = buildProgram();
+    try {
+      await program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "exec",
+        "--only",
+        "ANTHROPIC_API_KEY",
+        "--",
+        "env",
+      ]);
+    } catch {
+      // exit sentinel
+    }
+    const exitCode = exitSpy.mock.calls[0]?.[0] as number | undefined;
+
+    expect(exitCode).toBe(1);
+    const errText = errSpy.mock.calls.flat().join(" ");
+    expect(errText).toMatch(/high-security/i);
+    expect(errText).toMatch(/proxy/i);
+  });
+});
+
 describe("secrets generate-link", () => {
   it("mints one-time submission links for personal secrets", async () => {
     const program = buildProgram();

package/src/commands/secrets.ts

@@ -392,6 +392,13 @@ export async function loadRevealedSecrets(
     if (!res.ok) {
       const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
       const message = extractApiMessage(body, res.statusText);
+      // High-security ("nuclear") refusal surfaced at the batch level (rather
+      // than per-name): point the caller at the proxy and never leak plaintext.
+      if (body.code === "high_security_denied" || body.highSecurity === true) {
+        throw new Error(
+          "A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.",
+        );
+      }
       if (
         res.status >= 400 &&
         res.status < 500 &&
@@ -428,6 +435,17 @@ export async function loadRevealedSecrets(
     for (const key of chunk) {
       if (resolved.has(key)) continue;
       const err = errorsByName.get(key);
+      // High-security ("nuclear") secret: the server refuses to vend it on the
+      // local-injection (batch-load) path — per-name code `high_security_denied`,
+      // no plaintext returned. Every caller of loadRevealedSecrets injects or
+      // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
+      // `secrets env`), so a high-security secret can NEVER be used here. Surface
+      // a clear, actionable error pointing at the proxy instead of a raw failure.
+      if (err?.code === "high_security_denied") {
+        throw new Error(
+          `Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`,
+        );
+      }
       const reason =
         err?.code === "not_found"
           ? "Secret not found"
@@ -538,6 +556,23 @@ export function registerSecretsCommand(program: Command): void {
 
         if (!res.ok) {
           const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+          // High-security ("nuclear") secret: the server refuses to reveal it on
+          // the local-injection path (403, no plaintext). Surface a clear,
+          // actionable error pointing the user at the proxy rather than a raw
+          // 4xx — the value can ONLY be used through the server-side proxy.
+          if (res.status === 403 && body.highSecurity === true) {
+            console.error(
+              chalk.red(
+                `Secret '${name}' is high-security and cannot be revealed locally.`,
+              ),
+            );
+            console.error(
+              chalk.dim(
+                "  It can only be used through the HQ secret proxy, which keeps the plaintext server-side.",
+              ),
+            );
+            process.exit(1);
+          }
           console.error(
             chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`),
           );

package/src/run/hq-plugin.test.ts

@@ -153,4 +153,43 @@ describe('hq-plugin', () => {
     const fooErrors = (graph as any).configSchema['FOO'].errors as Array<{ message: string }>;
     expect(fooErrors.some((e) => e.message.includes('No read permission for secret "FOO"'))).toBe(true);
   });
+
+  // US-003 (secrets-server-proxy): the server refuses to batch-load a
+  // high-security ("nuclear") secret (code: high_security_denied, no plaintext).
+  // `hq run` injects plaintext into the child env, so it must surface this as a
+  // clear, actionable error pointing at the proxy — and never resolve a value.
+  it('high-security-denied: nuclear secret is surfaced as a proxy-pointing ResolutionError, no value', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nANTHROPIC_API_KEY=hq()\n`);
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => ({
+        secrets: [],
+        errors: [
+          {
+            name: 'ANTHROPIC_API_KEY',
+            code: 'high_security_denied',
+            message: 'high-security; use the proxy',
+          },
+        ],
+      }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+    await prewarmHqSecrets(graph, mocks, state);
+    await graph.resolveEnvValues();
+
+    const errs = (graph as any).configSchema['ANTHROPIC_API_KEY'].errors as Array<{ message: string }>;
+    expect(errs.some((e) => /high-security/i.test(e.message) && /proxy/i.test(e.message))).toBe(true);
+    // No plaintext value was resolved for the nuclear secret.
+    expect((graph.getResolvedEnvObject() as Record<string, unknown>).ANTHROPIC_API_KEY).toBeUndefined();
+  });
 });

package/src/run/hq-plugin.ts

@@ -85,6 +85,13 @@ export function installHqPlugin(graph: any /* EnvGraph */, opts: InstallHqPlugin
           if (err.code === 'not_found') {
             throw new ResolutionError(`Secret "${secretName}" does not exist in company`);
           }
+          // High-security ("nuclear") secret: the server refuses to vend it on
+          // the local-injection path. It can ONLY be used through the
+          // server-side proxy, so `hq run` (which injects plaintext into the
+          // child env) can never load it. Surface a clear, actionable error.
+          if (err.code === 'high_security_denied') {
+            throw new ResolutionError(`Secret "${secretName}" is high-security and cannot be injected locally — it can only be used via the HQ secret proxy (POST /secrets/{companyUid}/proxy/{path}), which keeps the plaintext server-side. Remove it from this schema's locally-injected vars.`);
+          }
           throw new ResolutionError(`Failed to load secret "${secretName}": ${err.message ?? err.code}`);
         }
         // Sentinel-check style throughout: `readCache` returns `string | null`

package/src/sentry.ts

@@ -2,13 +2,17 @@ import * as Sentry from "@sentry/node";
 import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
 import { beforeSend } from "./sentry-before-send.js";
 import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
+import { CLI_VERSION } from "./cli-version.js";
 
 export function initSentry(): void {
   const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
   if (!dsn) return;
   Sentry.init({
     dsn,
-    release: `hq-cli@${process.env.npm_package_version ?? "0.0.0"}`,
+    // CLI_VERSION reads package.json at runtime; npm_package_version is only
+    // set under `npm run`, so an installed `hq` binary would always report
+    // 0.0.0 and never match the uploaded source maps.
+    release: `hq-cli@${CLI_VERSION}`,
     environment: process.env.HQ_CLI_ENV ?? "production",
     initialScope: {
       tags: { repo: "hq-cli" },

package/src/utils/feedback-diagnostics.test.ts

@@ -91,6 +91,17 @@ describe("collectDiagnostics", () => {
     if (saved !== undefined) process.env.npm_package_version = saved;
   });
 
+  it("attaches a versions block carrying the cli version (core/sync best-effort)", () => {
+    const blob = collectDiagnostics();
+    expect(blob.versions.cli).toBe(CLI_VERSION);
+    // core + sync are environment-dependent; they must be present as
+    // string | null, never undefined, so triage always gets the shape.
+    expect(blob.versions).toHaveProperty("core");
+    expect(blob.versions).toHaveProperty("sync");
+    expect(["string", "object"]).toContain(typeof blob.versions.core); // string | null
+    expect(["string", "object"]).toContain(typeof blob.versions.sync); // string | null
+  });
+
   it("cliVersion is unaffected by npm_package_version env var", () => {
     process.env.npm_package_version = "99.99.99";
     const blob = collectDiagnostics();

package/src/utils/feedback-diagnostics.ts

@@ -2,6 +2,7 @@ import * as os from "os";
 import { execFileSync } from "child_process";
 import { getRecentBreadcrumbs } from "./breadcrumb-buffer.js";
 import { CLI_VERSION } from "../cli-version.js";
+import { collectVersions, type VersionInfo } from "./feedback-versions.js";
 
 export interface GitContext {
   branch: string | null;
@@ -12,6 +13,12 @@ export interface GitContext {
 
 export interface DiagnosticsBlob {
   cliVersion: string;
+  /**
+   * The hq-cli, hq-core, and hq-sync versions from the submitter's
+   * environment. `cliVersion` above is retained for back-compat; new
+   * consumers should read `versions` (which carries core + sync too).
+   */
+  versions: VersionInfo;
   nodeVersion: string;
   os: { platform: string; release: string; arch: string };
   command: string[];
@@ -101,6 +108,7 @@ function collectGitContext(): GitContext {
 export function collectDiagnostics(): DiagnosticsBlob {
   return {
     cliVersion: CLI_VERSION,
+    versions: collectVersions(),
     nodeVersion: process.version,
     os: {
       platform: os.platform(),

package/src/utils/feedback-screenshots.test.ts

@@ -0,0 +1,134 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+vi.mock("./vault-api.js", () => ({
+  vaultApiFetch: vi.fn(),
+}));
+
+import { vaultApiFetch } from "./vault-api.js";
+import {
+  MAX_SCREENSHOTS,
+  contentTypeForPath,
+  loadScreenshots,
+  uploadScreenshots,
+} from "./feedback-screenshots.js";
+
+let tmp: string;
+
+beforeEach(() => {
+  tmp = fs.mkdtempSync(path.join(os.tmpdir(), "shots-"));
+  vi.mocked(vaultApiFetch).mockReset();
+});
+afterEach(() => {
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+function writePng(name: string, bytes = Buffer.from([0x89, 0x50, 0x4e, 0x47])): string {
+  const p = path.join(tmp, name);
+  fs.writeFileSync(p, bytes);
+  return p;
+}
+
+describe("contentTypeForPath", () => {
+  it("maps known image extensions (case-insensitive)", () => {
+    expect(contentTypeForPath("a.png")).toBe("image/png");
+    expect(contentTypeForPath("a.JPG")).toBe("image/jpeg");
+    expect(contentTypeForPath("a.jpeg")).toBe("image/jpeg");
+    expect(contentTypeForPath("a.webp")).toBe("image/webp");
+    expect(contentTypeForPath("a.gif")).toBe("image/gif");
+  });
+  it("rejects unsupported extensions", () => {
+    expect(() => contentTypeForPath("a.pdf")).toThrow(/unsupported screenshot type/);
+    expect(() => contentTypeForPath("a")).toThrow(/unsupported screenshot type/);
+  });
+});
+
+describe("loadScreenshots", () => {
+  it("reads valid images with their content types", () => {
+    const a = writePng("a.png");
+    const loaded = loadScreenshots([a]);
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0].contentType).toBe("image/png");
+    expect(loaded[0].bytes.byteLength).toBeGreaterThan(0);
+  });
+  it("rejects more than MAX_SCREENSHOTS", () => {
+    const paths = Array.from({ length: MAX_SCREENSHOTS + 1 }, (_, i) => writePng(`s${i}.png`));
+    expect(() => loadScreenshots(paths)).toThrow(new RegExp(`at most ${MAX_SCREENSHOTS}`));
+  });
+  it("rejects a missing file", () => {
+    expect(() => loadScreenshots([path.join(tmp, "nope.png")])).toThrow(/cannot read screenshot/);
+  });
+  it("rejects an empty file", () => {
+    expect(() => loadScreenshots([writePng("empty.png", Buffer.alloc(0))])).toThrow(/empty/);
+  });
+});
+
+describe("uploadScreenshots", () => {
+  it("returns [] without calling the API when no paths given", async () => {
+    const keys = await uploadScreenshots({ paths: [], token: "t" });
+    expect(keys).toEqual([]);
+    expect(vaultApiFetch).not.toHaveBeenCalled();
+  });
+
+  it("presigns, PUTs each image to S3, and returns the keys", async () => {
+    const a = writePng("a.png");
+    const b = writePng("b.jpg");
+    vi.mocked(vaultApiFetch).mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        screenshots: [
+          { key: "feedback-screenshots/prs_a/sub/0.png", url: "https://s3/put0", contentType: "image/png" },
+          { key: "feedback-screenshots/prs_a/sub/1.jpg", url: "https://s3/put1", contentType: "image/jpeg" },
+        ],
+      }),
+    } as unknown as Response);
+    const putCalls: Array<{ url: string; method?: string; contentType?: unknown }> = [];
+    const fetchImpl = vi.fn(async (url: string, init: { method?: string; headers?: Record<string, string> }) => {
+      putCalls.push({ url, method: init.method, contentType: init.headers?.["Content-Type"] });
+      return { ok: true, status: 200 } as Response;
+    }) as unknown as typeof fetch;
+
+    const keys = await uploadScreenshots({ paths: [a, b], token: "tok", fetchImpl });
+
+    expect(keys).toEqual([
+      "feedback-screenshots/prs_a/sub/0.png",
+      "feedback-screenshots/prs_a/sub/1.jpg",
+    ]);
+    // Presign request asked for the right content types.
+    const presignBody = vi.mocked(vaultApiFetch).mock.calls[0][0].body;
+    expect(presignBody).toEqual({ contentTypes: ["image/png", "image/jpeg"] });
+    // One PUT per image, to the presigned URL, with the right Content-Type.
+    expect(putCalls).toEqual([
+      { url: "https://s3/put0", method: "PUT", contentType: "image/png" },
+      { url: "https://s3/put1", method: "PUT", contentType: "image/jpeg" },
+    ]);
+  });
+
+  it("throws when the presign call fails", async () => {
+    const a = writePng("a.png");
+    vi.mocked(vaultApiFetch).mockResolvedValue({
+      ok: false,
+      statusText: "Bad Request",
+      json: async () => ({ error: "at most 5 screenshots are allowed" }),
+    } as unknown as Response);
+    await expect(uploadScreenshots({ paths: [a], token: "t" })).rejects.toThrow(
+      /Failed to presign screenshots: at most 5/,
+    );
+  });
+
+  it("throws when an S3 upload fails", async () => {
+    const a = writePng("a.png");
+    vi.mocked(vaultApiFetch).mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        screenshots: [{ key: "feedback-screenshots/prs_a/sub/0.png", url: "https://s3/put0", contentType: "image/png" }],
+      }),
+    } as unknown as Response);
+    const fetchImpl = vi.fn(async () => ({ ok: false, status: 403 }) as Response) as unknown as typeof fetch;
+    await expect(uploadScreenshots({ paths: [a], token: "t", fetchImpl })).rejects.toThrow(
+      /Failed to upload screenshot .*: HTTP 403/,
+    );
+  });
+});