@indigoai-us/hq-cli 5.5.0 → 5.5.2

package/src/commands/cloud.ts

@@ -1,125 +1,238 @@
 /**
- * hq sync commands — cloud sync management
- * Bridges hq-cli to @indigoai-us/hq-cloud
+ * `hq sync` commands — push/pull files between the local HQ tree and the
+ * company's S3 vault bucket.
+ *
+ * VLT-5 model: each command resolves a Cognito access token, asks
+ * vault-service for the company's bucket + STS-vended credentials, and
+ * runs the operation. No daemon, no init step (handled by `hq onboard`),
+ * no long-lived background process — every invocation is self-contained.
+ *
+ * Subcommands:
+ *   hq sync push [paths...]   — broadcast local file(s) to the vault
+ *   hq sync pull              — pull all permitted files from the vault
+ *   hq sync status            — show local journal summary
  */
 
 import { Command } from "commander";
-import { findHqRoot } from "../utils/manifest.js";
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+
+import {
+  share,
+  sync,
+  readJournal,
+  getJournalPath,
+  type ConflictStrategy,
+} from "@indigoai-us/hq-cloud";
+
+import {
+  DEFAULT_HQ_ROOT,
+  ensureCognitoToken,
+  buildVaultConfig,
+} from "../utils/cognito-session.js";
+
+interface CommonSyncOptions {
+  hqRoot: string;
+  company?: string;
+}
 
 export function registerCloudCommands(program: Command): void {
   program
-    .command("init")
-    .description("Authenticate with IndigoAI and set up cloud sync")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { initSync } = await import("@indigoai-us/hq-cloud");
-        await initSync(hqRoot);
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
-        );
-        process.exit(1);
-      }
-    });
+    .command("push")
+    .description("Push local file(s) to the company vault on S3")
+    .argument("[paths...]", "Paths to push (defaults to current directory)")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .option(
+      "--company <slug>",
+      "Company slug or UID (defaults to active company in .hq/config.json)",
+    )
+    .option(
+      "--message <msg>",
+      "Optional message attached to journal entries for these uploads",
+    )
+    .option(
+      "--on-conflict <strategy>",
+      "Conflict strategy: overwrite | keep | abort (omit for interactive)",
+    )
+    .action(
+      async (
+        paths: string[],
+        options: CommonSyncOptions & {
+          message?: string;
+          onConflict?: ConflictStrategy;
+        },
+      ) => {
+        try {
+          const targetPaths =
+            paths && paths.length > 0 ? paths : [process.cwd()];
 
-  program
-    .command("start")
-    .description("Start the background sync daemon")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { startDaemon } = await import("@indigoai-us/hq-cloud");
-        await startDaemon(hqRoot);
-        console.log("Sync daemon started. Use 'hq sync status' to check.");
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
-        );
-        process.exit(1);
-      }
-    });
+          console.log(chalk.bold("\nHQ Sync — Push"));
+          console.log(`  HQ root:  ${options.hqRoot}`);
+          console.log(`  Company:  ${options.company ?? "(from .hq/config.json)"}`);
+          console.log(`  Paths:    ${targetPaths.join(", ")}\n`);
 
-  program
-    .command("stop")
-    .description("Stop the sync daemon")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { stopDaemon } = await import("@indigoai-us/hq-cloud");
-        await stopDaemon(hqRoot);
-        console.log("Sync daemon stopped.");
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
-        );
-        process.exit(1);
-      }
-    });
+          const accessToken = await ensureCognitoToken();
+          const result = await share({
+            paths: targetPaths,
+            company: options.company,
+            message: options.message,
+            onConflict: options.onConflict,
+            vaultConfig: buildVaultConfig(accessToken),
+            hqRoot: options.hqRoot,
+          });
+
+          if (result.aborted) {
+            console.log(
+              chalk.yellow(
+                `\n⚠ Push aborted (${result.filesUploaded} uploaded, ${result.filesSkipped} skipped)`,
+              ),
+            );
+            process.exit(1);
+          }
+
+          console.log(
+            chalk.green(
+              `\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`,
+            ),
+          );
+        } catch (err) {
+          console.error(
+            chalk.red("\n✗ Push failed:"),
+            err instanceof Error ? err.message : String(err),
+          );
+          process.exit(1);
+        }
+      },
+    );
 
   program
-    .command("status")
-    .description("Show sync status")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { getStatus } = await import("@indigoai-us/hq-cloud");
-        const status = await getStatus(hqRoot);
-        console.log(`  State:      ${status.running ? "running" : "stopped"}`);
-        console.log(`  Last sync:  ${status.lastSync || "never"}`);
-        console.log(`  Files:      ${status.fileCount} tracked`);
-        console.log(`  Bucket:     ${status.bucket || "not configured"}`);
-        if (status.errors.length > 0) {
-          console.log(`  Errors:     ${status.errors.length}`);
-          for (const err of status.errors.slice(0, 5)) {
-            console.log(`    - ${err}`);
+    .command("pull")
+    .description("Pull permitted files from the company vault to local HQ")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .option(
+      "--company <slug>",
+      "Company slug or UID (defaults to active company in .hq/config.json)",
+    )
+    .option(
+      "--on-conflict <strategy>",
+      "Conflict strategy: overwrite | keep | abort (omit for interactive)",
+    )
+    .action(
+      async (
+        options: CommonSyncOptions & {
+          onConflict?: ConflictStrategy;
+        },
+      ) => {
+        try {
+          console.log(chalk.bold("\nHQ Sync — Pull"));
+          console.log(`  HQ root:  ${options.hqRoot}`);
+          console.log(`  Company:  ${options.company ?? "(from .hq/config.json)"}\n`);
+
+          const accessToken = await ensureCognitoToken();
+          const result = await sync({
+            company: options.company,
+            onConflict: options.onConflict,
+            vaultConfig: buildVaultConfig(accessToken),
+            hqRoot: options.hqRoot,
+          });
+
+          if (result.aborted) {
+            console.log(
+              chalk.yellow(
+                `\n⚠ Pull aborted (${result.filesDownloaded} downloaded, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`,
+              ),
+            );
+            process.exit(1);
           }
+
+          console.log(
+            chalk.green(
+              `\n✓ Pulled ${result.filesDownloaded} file(s) (${formatBytes(result.bytesDownloaded)}, ${result.filesSkipped} skipped, ${result.conflicts} conflicts)`,
+            ),
+          );
+        } catch (err) {
+          console.error(
+            chalk.red("\n✗ Pull failed:"),
+            err instanceof Error ? err.message : String(err),
+          );
+          process.exit(1);
         }
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
-        );
-        process.exit(1);
-      }
-    });
+      },
+    );
 
   program
-    .command("push")
-    .description("Force push all local changes to cloud")
-    .action(async () => {
+    .command("status")
+    .description("Show local sync journal summary")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .action((options: { hqRoot: string }) => {
       try {
-        const hqRoot = findHqRoot();
-        const { pushAll } = await import("@indigoai-us/hq-cloud");
-        const result = await pushAll(hqRoot);
-        console.log(`Pushed ${result.filesUploaded} files to cloud.`);
-      } catch (error) {
-        console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
+        const journalPath = getJournalPath(options.hqRoot);
+        if (!fs.existsSync(journalPath)) {
+          console.log(chalk.dim("No sync journal yet — run `hq sync push` or `hq sync pull` to create one."));
+          console.log(chalk.dim(`  Expected at: ${journalPath}`));
+          return;
+        }
+
+        const journal = readJournal(options.hqRoot);
+        const entries = Object.entries(journal.files ?? {});
+        const lastSyncTimes = entries
+          .map(([, entry]) => entry.syncedAt)
+          .filter((t): t is string => typeof t === "string")
+          .sort();
+        const lastSync = lastSyncTimes.at(-1) ?? "never";
+        const totalBytes = entries.reduce(
+          (acc, [, entry]) => acc + (entry.size ?? 0),
+          0,
         );
-        process.exit(1);
-      }
-    });
 
-  program
-    .command("pull")
-    .description("Force pull all cloud changes to local")
-    .action(async () => {
-      try {
-        const hqRoot = findHqRoot();
-        const { pullAll } = await import("@indigoai-us/hq-cloud");
-        const result = await pullAll(hqRoot);
-        console.log(`Pulled ${result.filesDownloaded} files from cloud.`);
-      } catch (error) {
+        const configPath = path.join(options.hqRoot, ".hq", "config.json");
+        let activeCompany: string | undefined;
+        if (fs.existsSync(configPath)) {
+          try {
+            const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+            activeCompany = cfg.activeCompany;
+          } catch {
+            // ignore
+          }
+        }
+
+        console.log(chalk.bold("\nHQ Sync — Status"));
+        console.log(`  HQ root:        ${options.hqRoot}`);
+        console.log(`  Active company: ${activeCompany ?? chalk.dim("(none)")}`);
+        console.log(`  Tracked files:  ${entries.length}`);
+        console.log(`  Total size:     ${formatBytes(totalBytes)}`);
+        console.log(`  Last sync:      ${lastSync}`);
+        console.log(`  Journal:        ${journalPath}`);
+      } catch (err) {
         console.error(
-          "Error:",
-          error instanceof Error ? error.message : error
+          chalk.red("✗ Status failed:"),
+          err instanceof Error ? err.message : String(err),
         );
         process.exit(1);
       }
     });
 }
+
+function formatBytes(bytes: number): string {
+  if (bytes === 0) return "0 B";
+  const units = ["B", "KB", "MB", "GB"];
+  const exponent = Math.min(
+    Math.floor(Math.log(bytes) / Math.log(1024)),
+    units.length - 1,
+  );
+  const value = bytes / Math.pow(1024, exponent);
+  return `${value.toFixed(value >= 100 || exponent === 0 ? 0 : 1)} ${units[exponent]}`;
+}

package/src/commands/list.ts

@@ -29,10 +29,29 @@ export function registerListCommand(program: Command): void {
         console.log('Modules:\n');
 
         for (const module of manifest.modules) {
+          console.log(`  ${module.name}`);
+
+          if (module.strategy === 'package') {
+            // hq-pack content pack — wired by scripts/scan-packages.sh
+            console.log(`    Strategy: package`);
+            console.log(`    Source:   ${module.source}`);
+            if (module.version) {
+              console.log(`    Version:  ${module.version}`);
+            }
+            if (module.installed_at) {
+              console.log(`    Path:     ${module.installed_at}`);
+            }
+            if (module.resolved_sha) {
+              console.log(`    SHA:      ${module.resolved_sha}`);
+            }
+            console.log();
+            continue;
+          }
+
+          // legacy git-repo module
           const moduleDir = path.join(modulesDir, module.name);
           const installed = await isRepo(moduleDir);
 
-          console.log(`  ${module.name}`);
           console.log(`    Repo:     ${module.repo}`);
           console.log(`    Branch:   ${module.branch || 'main'}`);
           console.log(`    Strategy: ${module.strategy}`);

package/src/commands/login.ts

@@ -1,23 +1,42 @@
 /**
- * hq login — opens browser for Clerk auth, caches token (US-004)
+ * hq login — opens browser for Cognito auth via Google OAuth
  */
 
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { startAuthFlow } from '../utils/auth.js';
-import { saveToken } from '../utils/token-store.js';
-import { getRegistryUrl } from '../utils/registry-client.js';
+import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
+import { DEFAULT_COGNITO } from '../utils/cognito-session.js';
+
+function peekIdToken(idToken: string): { email?: string; sub?: string } {
+  try {
+    const payload = idToken.split('.')[1];
+    if (!payload) return {};
+    const pad = payload.length % 4 === 0 ? '' : '='.repeat(4 - (payload.length % 4));
+    const normalized = payload.replace(/-/g, '+').replace(/_/g, '/') + pad;
+    const decoded = JSON.parse(Buffer.from(normalized, 'base64').toString('utf-8'));
+    return { email: decoded.email, sub: decoded.sub };
+  } catch {
+    return {};
+  }
+}
 
 export function registerLoginCommand(program: Command): void {
   program
     .command('login')
-    .description('Authenticate with the HQ package registry')
+    .description('Authenticate with HQ via Cognito (Google OAuth)')
     .action(async () => {
       try {
-        const registryUrl = getRegistryUrl();
-        const token = await startAuthFlow(registryUrl);
-        await saveToken(token);
-        console.log(chalk.green(`Logged in as ${token.email}`));
+        const existing = loadCachedTokens();
+        if (existing && !isExpiring(existing, 120)) {
+          const who = peekIdToken(existing.idToken).email ?? 'cached session';
+          console.log(chalk.green(`Already logged in as ${who}. Run \`hq logout\` to switch accounts.`));
+          return;
+        }
+
+        console.log('Opening browser for authentication...');
+        const tokens = await browserLogin(DEFAULT_COGNITO);
+        const who = peekIdToken(tokens.idToken).email ?? 'HQ';
+        console.log(chalk.green(`Logged in as ${who}`));
       } catch (error) {
         console.error(
           chalk.red('Login failed:'),

package/src/commands/logout.ts

@@ -1,10 +1,10 @@
 /**
- * hq logout — clears cached session (US-004)
+ * hq logout — clears cached Cognito session
  */
 
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { clearToken } from '../utils/token-store.js';
+import { clearCachedTokens, loadCachedTokens } from '@indigoai-us/hq-cloud';
 
 export function registerLogoutCommand(program: Command): void {
   program
@@ -12,7 +12,12 @@ export function registerLogoutCommand(program: Command): void {
     .description('Log out and clear cached credentials')
     .action(async () => {
       try {
-        await clearToken();
+        const existing = loadCachedTokens();
+        if (!existing) {
+          console.log(chalk.yellow('No cached HQ session'));
+          return;
+        }
+        clearCachedTokens();
         console.log(chalk.green('Logged out successfully'));
       } catch (error) {
         console.error(

package/src/commands/onboard.ts

@@ -0,0 +1,193 @@
+/**
+ * `hq onboard` — bootstrap an HQ vault: sign in to Cognito + provision
+ * the company entity, S3 bucket, KMS key, owner membership, and STS-vended
+ * credentials in one flow.
+ *
+ * This is the "the entire flow" entry point that VLT-9 was building toward:
+ * a real user can install hq-cli and run `hq onboard create-company` once
+ * to land in a fully provisioned vault, then use `hq sync push|pull` to
+ * round-trip files against S3.
+ *
+ * Subcommands:
+ *   hq onboard create-company  — provision a brand new company
+ *   hq onboard join            — accept an invite from another user
+ *   hq onboard resume          — resume a partially-completed flow from checkpoint
+ *   hq onboard dry-run         — show what create-company would do, without doing it
+ *
+ * Auth: we cache the Cognito access + refresh tokens at ~/.hq/cognito-tokens.json.
+ * If the cached token is missing or expired beyond the refresh window, the
+ * browser-OAuth flow opens automatically.
+ */
+
+import { Command } from "commander";
+import chalk from "chalk";
+
+import { runOnboardCli } from "@indigoai-us/hq-onboarding";
+import {
+  DEFAULT_HQ_ROOT,
+  ensureCognitoToken,
+  buildVaultConfig,
+} from "../utils/cognito-session.js";
+
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+
+export function registerOnboardCommand(program: Command): void {
+  const onboard = program
+    .command("onboard")
+    .description("Provision an HQ vault: sign in, create company, S3 bucket, STS, sync");
+
+  onboard
+    .command("create-company")
+    .description("Sign in and provision a brand new HQ vault for a company")
+    .requiredOption("--slug <slug>", "Company slug (used as bucket name suffix)")
+    .requiredOption("--name <name>", "Company display name")
+    .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
+    .requiredOption("--person-name <name>", "Your display name")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .action(async (options: {
+      slug: string;
+      name: string;
+      email: string;
+      personName: string;
+      hqRoot: string;
+    }) => {
+      try {
+        console.log(chalk.bold(`\nHQ Onboard — Create Company`));
+        console.log(`  Company:  ${options.name} (${options.slug})`);
+        console.log(`  Person:   ${options.personName} <${options.email}>`);
+        console.log(`  HQ root:  ${options.hqRoot}\n`);
+
+        const accessToken = await ensureCognitoToken();
+        const result = await runOnboardCli({
+          mode: "create-company",
+          personName: options.personName,
+          personEmail: options.email,
+          companyName: options.name,
+          companySlug: options.slug,
+          vaultConfig: buildVaultConfig(accessToken),
+          hqRoot: options.hqRoot,
+        });
+
+        if (!result.success) {
+          console.error(chalk.red(`\n✗ Onboarding failed: ${result.error}`));
+          process.exit(1);
+        }
+      } catch (err) {
+        console.error(
+          chalk.red("\n✗ Error:"),
+          err instanceof Error ? err.message : String(err),
+        );
+        process.exit(1);
+      }
+    });
+
+  onboard
+    .command("join")
+    .description("Accept an invite and join an existing company")
+    .requiredOption("--invite-token <token>", "Magic link token from your invite email")
+    .requiredOption("--email <email>", "Your email (must match Cognito sign-in)")
+    .requiredOption("--person-name <name>", "Your display name")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .action(async (options: {
+      inviteToken: string;
+      email: string;
+      personName: string;
+      hqRoot: string;
+    }) => {
+      try {
+        console.log(chalk.bold(`\nHQ Onboard — Join Company`));
+        console.log(`  Person:   ${options.personName} <${options.email}>`);
+        console.log(`  HQ root:  ${options.hqRoot}\n`);
+
+        const accessToken = await ensureCognitoToken();
+        const result = await runOnboardCli({
+          mode: "join-company",
+          personName: options.personName,
+          personEmail: options.email,
+          inviteToken: options.inviteToken,
+          vaultConfig: buildVaultConfig(accessToken),
+          hqRoot: options.hqRoot,
+        });
+
+        if (!result.success) {
+          console.error(chalk.red(`\n✗ Join failed: ${result.error}`));
+          process.exit(1);
+        }
+      } catch (err) {
+        console.error(
+          chalk.red("\n✗ Error:"),
+          err instanceof Error ? err.message : String(err),
+        );
+        process.exit(1);
+      }
+    });
+
+  onboard
+    .command("resume")
+    .description("Resume a partially-completed onboarding flow from local checkpoint")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .action(async (options: { hqRoot: string }) => {
+      try {
+        const accessToken = await ensureCognitoToken();
+        const result = await runOnboardCli({
+          mode: "resume",
+          vaultConfig: buildVaultConfig(accessToken),
+          hqRoot: options.hqRoot,
+        });
+        if (!result.success) {
+          console.error(chalk.red(`\n✗ Resume failed: ${result.error}`));
+          process.exit(1);
+        }
+      } catch (err) {
+        console.error(
+          chalk.red("\n✗ Error:"),
+          err instanceof Error ? err.message : String(err),
+        );
+        process.exit(1);
+      }
+    });
+
+  onboard
+    .command("dry-run")
+    .description("Show what create-company would do, without provisioning anything")
+    .option(
+      "--hq-root <path>",
+      `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`,
+      DEFAULT_HQ_ROOT,
+    )
+    .action(async (options: { hqRoot: string }) => {
+      try {
+        // No auth needed for dry-run — runOnboardCli handles this branch
+        // without touching the vault-service.
+        const result = await runOnboardCli({
+          mode: "dry-run",
+          vaultConfig: buildVaultConfig("dry-run-no-token"),
+          hqRoot: options.hqRoot,
+        });
+        if (!result.success) {
+          console.error(chalk.red(`\n✗ Dry-run failed: ${result.error}`));
+          process.exit(1);
+        }
+      } catch (err) {
+        console.error(
+          chalk.red("\n✗ Error:"),
+          err instanceof Error ? err.message : String(err),
+        );
+        process.exit(1);
+      }
+    });
+}