@indigoai-us/hq-cli 5.5.0 → 5.5.2-sentry-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.5.0",
+  "version": "5.5.2-sentry-rc.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -8,28 +8,39 @@
     "hq-auth-refresh": "dist/bin/hq-auth-refresh.js"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node scripts/generate-dsn.mjs && tsc",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "5.1.0",
+    "@sentry/node": "^10.49.0",
+    "@indigoai-us/hq-cloud": "^5.1.0",
+    "@indigoai-us/hq-onboarding": "^0.1.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
-    "simple-git": "^3.27.0"
+    "simple-git": "^3.27.0",
+    "semver": "^7.6.3"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "@types/semver": "^7.5.8"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/indigoai-us/hq.git",
     "directory": "packages/hq-cli"
   },
-  "keywords": ["hq", "ai", "modules", "sync", "cloud"],
+  "keywords": [
+    "hq",
+    "ai",
+    "modules",
+    "sync",
+    "cloud"
+  ],
   "license": "MIT",
   "type": "module"
 }

package/scripts/generate-dsn.mjs

@@ -0,0 +1,26 @@
+import { writeFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+const isGitHubActions = process.env.GITHUB_ACTIONS === "true";
+const isPublishJob = process.env.GITHUB_JOB === "publish";
+const dsn = process.env.HQ_CLI_PUBLISH_SENTRY_DSN ?? "";
+
+if (isGitHubActions && isPublishJob && !dsn) {
+  process.stderr.write(
+    "[generate-dsn] FATAL: GITHUB_ACTIONS=true, GITHUB_JOB=publish, " +
+      "but HQ_CLI_PUBLISH_SENTRY_DSN is not set. " +
+      "Add the repo secret HQ_CLI_PUBLISH_SENTRY_DSN before publishing.\n",
+  );
+  process.exit(1);
+}
+
+const outPath = join(__dirname, "../src/sentry-dsn.generated.ts");
+const content = `export const BUNDLED_DSN = "${dsn}";\n`;
+
+writeFileSync(outPath, content, "utf8");
+process.stdout.write(
+  `[generate-dsn] Wrote BUNDLED_DSN="${dsn ? "[DSN set]" : ""}" to ${outPath}\n`,
+);

package/src/bin/hq-auth-refresh.ts

@@ -11,22 +11,29 @@
  * Writes the refreshed tokens to ~/.hq/cognito-tokens.json.
  */
 
+import { initSentry, Sentry } from "../sentry.js";
 import { refreshCachedSession } from "../utils/cognito-session.js";
 
-async function main(): Promise<void> {
-  const result = await refreshCachedSession();
-  if (result.refreshed) {
-    process.exit(0);
-  }
-  if (result.reason) {
-    process.stderr.write(`hq-auth-refresh: ${result.reason}\n`);
-  }
-  process.exit(1);
-}
+initSentry();
 
-main().catch((err) => {
-  process.stderr.write(
-    `hq-auth-refresh: ${err instanceof Error ? err.message : String(err)}\n`,
-  );
-  process.exit(1);
-});
+(async () => {
+  let exitCode = 1;
+  try {
+    const result = await refreshCachedSession();
+    if (result.refreshed) {
+      exitCode = 0;
+    } else {
+      if (result.reason) {
+        process.stderr.write(`hq-auth-refresh: ${result.reason}\n`);
+      }
+    }
+  } catch (err) {
+    Sentry.captureException(err);
+    process.stderr.write(
+      `hq-auth-refresh: ${err instanceof Error ? err.message : String(err)}\n`,
+    );
+  } finally {
+    await Sentry.flush(2000);
+    process.exit(exitCode);
+  }
+})();

package/src/commands/_patterns.ts

@@ -0,0 +1,2 @@
+export const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/;
+export const GROUP_ID_PATTERN = /^grp_[A-Za-z0-9_-]+$/;

package/src/commands/add.ts

@@ -4,7 +4,7 @@
 
 import { Command } from 'commander';
 import { findHqRoot, addModule, parseRepoName, isValidRepoUrl } from '../utils/manifest.js';
-import type { ModuleDefinition, SyncStrategy } from '../types.js';
+import type { LegacyModuleDefinition, LegacyStrategy } from '../types.js';
 
 export function registerAddCommand(program: Command): void {
   program
@@ -30,9 +30,10 @@ export function registerAddCommand(program: Command): void {
         // Parse name
         const name = options.as || parseRepoName(repoUrl);
 
-        // Validate strategy
-        const validStrategies: SyncStrategy[] = ['link', 'merge', 'copy'];
-        if (!validStrategies.includes(options.strategy as SyncStrategy)) {
+        // Validate strategy (hq modules add is for legacy git-repo modules;
+        // content packs are added via `hq install`, not `hq modules add`)
+        const validStrategies: LegacyStrategy[] = ['link', 'merge', 'copy'];
+        if (!validStrategies.includes(options.strategy as LegacyStrategy)) {
           console.error(`Error: Invalid strategy "${options.strategy}". Use: ${validStrategies.join(', ')}`);
           process.exit(1);
         }
@@ -48,11 +49,11 @@ export function registerAddCommand(program: Command): void {
             })
           : [{ src: '.', dest: `workers/${name}` }]; // Default: entire repo to workers/
 
-        const module: ModuleDefinition = {
+        const module: LegacyModuleDefinition = {
           name,
           repo: repoUrl,
           branch: options.branch,
-          strategy: options.strategy as SyncStrategy,
+          strategy: options.strategy as LegacyStrategy,
           paths,
         };
 

package/src/commands/auth.ts

@@ -12,9 +12,6 @@
  * into this machine by writing ~/.hq/cognito-tokens.json; once cached, the
  * session is kept fresh by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
- *
- * Note: the top-level `hq login` command authenticates against the HQ package
- * registry (Clerk), not Cognito — that is a different auth stack.
  */
 
 import { Command } from "commander";

package/src/commands/cloud.ts

@@ -1,125 +1,238 @@
 /**
- * hq sync commands — cloud sync management
- * Bridges hq-cli to @indigoai-us/hq-cloud
+ * `hq sync` commands — push/pull files between the local HQ tree and the
+ * company's S3 vault bucket.
+ *
+ * VLT-5 model: each command resolves a Cognito access token, asks
+ * vault-service for the company's bucket + STS-vended credentials, and
+ * runs the operation. No daemon, no init step (handled by `hq onboard`),
+ * no long-lived background process — every invocation is self-contained.
+ *
+ * Subcommands:
+ *   hq sync push [paths...]   — broadcast local file(s) to the vault
+ *   hq sync pull              — pull all permitted files from the vault
+ *   hq sync status            — show local journal summary
  */
 
 import { Command } from "commander";
-import { findHqRoot } from "../utils/manifest.js";
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+
+import {
+  share,
+  sync,
+  readJournal,
+  getJournalPath,
+  type ConflictStrategy,
+} from "@indigoai-us/hq-cloud";
+
+import {
+  DEFAULT_HQ_ROOT,
+  ensureCognitoToken,
+  buildVaultConfig,
+} from "../utils/cognito-session.js";
+
+interface CommonSyncOptions {
+  hqRoot: string;
+  company?: string;
+}
 
 export function registerCloudCommands(program: Command): void {
   program
-    .command("init")
-    .description("Authenticate with IndigoAI and set up cloud sync")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { initSync } = await import("@indigoai-us/hq-cloud");
-        await initSync(hqRoot);
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
-        );
-        process.exit(1);
-      }
-    });
+    .command("push")
+    .description("Push local file(s) to the company vault on S3")
+    .argument("[paths...]", "Paths to push (defaults to current directory)")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .option(
+      "--company <slug>",
+      "Company slug or UID (defaults to active company in .hq/config.json)",
+    )
+    .option(
+      "--message <msg>",
+      "Optional message attached to journal entries for these uploads",
+    )
+    .option(
+      "--on-conflict <strategy>",
+      "Conflict strategy: overwrite | keep | abort (omit for interactive)",
+    )
+    .action(
+      async (
+        paths: string[],
+        options: CommonSyncOptions & {
+          message?: string;
+          onConflict?: ConflictStrategy;
+        },
+      ) => {
+        try {
+          const targetPaths =
+            paths && paths.length > 0 ? paths : [process.cwd()];
 
-  program
-    .command("start")
-    .description("Start the background sync daemon")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { startDaemon } = await import("@indigoai-us/hq-cloud");
-        await startDaemon(hqRoot);
-        console.log("Sync daemon started. Use 'hq sync status' to check.");
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
-        );
-        process.exit(1);
-      }
-    });
+          console.log(chalk.bold("\nHQ Sync — Push"));
+          console.log(`  HQ root:  ${options.hqRoot}`);
+          console.log(`  Company:  ${options.company ?? "(from .hq/config.json)"}`);
+          console.log(`  Paths:    ${targetPaths.join(", ")}\n`);
 
-  program
-    .command("stop")
-    .description("Stop the sync daemon")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { stopDaemon } = await import("@indigoai-us/hq-cloud");
-        await stopDaemon(hqRoot);
-        console.log("Sync daemon stopped.");
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
-        );
-        process.exit(1);
-      }
-    });
+          const accessToken = await ensureCognitoToken();
+          const result = await share({
+            paths: targetPaths,
+            company: options.company,
+            message: options.message,
+            onConflict: options.onConflict,
+            vaultConfig: buildVaultConfig(accessToken),
+            hqRoot: options.hqRoot,
+          });
+
+          if (result.aborted) {
+            console.log(
+              chalk.yellow(
+                `\n⚠ Push aborted (${result.filesUploaded} uploaded, ${result.filesSkipped} skipped)`,
+              ),
+            );
+            process.exit(1);
+          }
+
+          console.log(
+            chalk.green(
+              `\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`,
+            ),
+          );
+        } catch (err) {
+          console.error(
+            chalk.red("\n✗ Push failed:"),
+            err instanceof Error ? err.message : String(err),
+          );
+          process.exit(1);
+        }
+      },
+    );
 
   program
-    .command("status")
-    .description("Show sync status")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { getStatus } = await import("@indigoai-us/hq-cloud");
-        const status = await getStatus(hqRoot);
-        console.log(`  State:      ${status.running ? "running" : "stopped"}`);
-        console.log(`  Last sync:  ${status.lastSync || "never"}`);
-        console.log(`  Files:      ${status.fileCount} tracked`);
-        console.log(`  Bucket:     ${status.bucket || "not configured"}`);
-        if (status.errors.length > 0) {
-          console.log(`  Errors:     ${status.errors.length}`);
-          for (const err of status.errors.slice(0, 5)) {
-            console.log(`    - ${err}`);
+    .command("pull")
+    .description("Pull permitted files from the company vault to local HQ")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .option(
+      "--company <slug>",
+      "Company slug or UID (defaults to active company in .hq/config.json)",
+    )
+    .option(
+      "--on-conflict <strategy>",
+      "Conflict strategy: overwrite | keep | abort (omit for interactive)",
+    )
+    .action(
+      async (
+        options: CommonSyncOptions & {
+          onConflict?: ConflictStrategy;
+        },
+      ) => {
+        try {
+          console.log(chalk.bold("\nHQ Sync — Pull"));
+          console.log(`  HQ root:  ${options.hqRoot}`);
+          console.log(`  Company:  ${options.company ?? "(from .hq/config.json)"}\n`);
+
+          const accessToken = await ensureCognitoToken();
+          const result = await sync({
+            company: options.company,
+            onConflict: options.onConflict,
+            vaultConfig: buildVaultConfig(accessToken),
+            hqRoot: options.hqRoot,
+          });
+
+          if (result.aborted) {
+            console.log(
+              chalk.yellow(
+                `\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`,
+              ),
+            );
+            process.exit(1);
           }
+
+          console.log(
+            chalk.green(
+              `\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`,
+            ),
+          );
+        } catch (err) {
+          console.error(
+            chalk.red("\n✗ Pull failed:"),
+            err instanceof Error ? err.message : String(err),
+          );
+          process.exit(1);
         }
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
-        );
-        process.exit(1);
-      }
-    });
+      },
+    );
 
   program
-    .command("push")
-    .description("Force push all local changes to cloud")
-    .action(async () => {
+    .command("status")
+    .description("Show local sync journal summary")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .action((options: { hqRoot: string }) => {
       try {
-        const hqRoot = findHqRoot();
-        const { pushAll } = await import("@indigoai-us/hq-cloud");
-        const result = await pushAll(hqRoot);
-        console.log(`Pushed ${result.filesUploaded} files to cloud.`);
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
+        const journalPath = getJournalPath(options.hqRoot);
+        if (!fs.existsSync(journalPath)) {
+          console.log(chalk.dim("No sync journal yet — run `hq sync push` or `hq sync pull` to create one."));
+          console.log(chalk.dim(`  Expected at: ${journalPath}`));
+          return;
+        }
+
+        const journal = readJournal(options.hqRoot);
+        const entries = Object.entries(journal.files ?? {});
+        const lastSyncTimes = entries
+          .map(([, entry]) => entry.syncedAt)
+          .filter((t): t is string => typeof t === "string")
+          .sort();
+        const lastSync = lastSyncTimes.at(-1) ?? "never";
+        const totalBytes = entries.reduce(
+          (acc, [, entry]) => acc + (entry.size ?? 0),
+          0,
         );
-        process.exit(1);
-      }
-    });
 
-  program
-    .command("pull")
-    .description("Force pull all cloud changes to local")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { pullAll } = await import("@indigoai-us/hq-cloud");
-        const result = await pullAll(hqRoot);
-        console.log(`Pulled ${result.filesDownloaded} files from cloud.`);
-      } catch (error) {
+        const configPath = path.join(options.hqRoot, ".hq", "config.json");
+        let activeCompany: string | undefined;
+        if (fs.existsSync(configPath)) {
+          try {
+            const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+            activeCompany = cfg.activeCompany;
+          } catch {
+            // ignore
+          }
+        }
+
+        console.log(chalk.bold("\nHQ Sync — Status"));
+        console.log(`  HQ root:        ${options.hqRoot}`);
+        console.log(`  Active company: ${activeCompany ?? chalk.dim("(none)")}`);
+        console.log(`  Tracked files:  ${entries.length}`);
+        console.log(`  Total size:     ${formatBytes(totalBytes)}`);
+        console.log(`  Last sync:      ${lastSync}`);
+        console.log(`  Journal:        ${journalPath}`);
+      } catch (err) {
         console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
+          chalk.red("✗ Status failed:"),
+          err instanceof Error ? err.message : String(err),
         );
         process.exit(1);
       }
     });
 }
+
+function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B";
+  const units = ["B", "KB", "MB", "GB"];
+  const exponent = Math.min(
+    Math.floor(Math.log(bytes) / Math.log(1024)),
+    units.length - 1,
+  );
+  const value = bytes / Math.pow(1024, exponent);
+  return `${value.toFixed(value >= 100 || exponent === 0 ? 0 : 1)} ${units[exponent]}`;
+}