@indigoai-us/hq-cli 5.5.1 → 5.5.2

package/dist/utils/secrets-cache.js

@@ -0,0 +1,134 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+const CACHE_DIR = path.join(os.homedir(), ".hq", "secrets-cache");
+const KEY_PATH = path.join(CACHE_DIR, ".key");
+const TTL_MS = 5 * 60 * 1000;
+const ALGORITHM = "aes-256-gcm";
+const IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+function ensureCacheDir(companyUid) {
+    const dir = path.join(CACHE_DIR, companyUid);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+}
+function validateInputs(companyUid, name) {
+    if (!companyUid || companyUid.includes("/") || companyUid.includes(".."))
+        return false;
+    if (!/^[A-Z][A-Z0-9_]*$/.test(name))
+        return false;
+    return true;
+}
+function getOrCreateKey() {
+    try {
+        const key = fs.readFileSync(KEY_PATH);
+        if (key.length === 32) {
+            const mode = fs.statSync(KEY_PATH).mode & 0o777;
+            if (mode !== 0o600) {
+                process.stderr.write(`Warning: secrets cache key has permissions ${mode.toString(8)}, expected 600\n`);
+            }
+            return key;
+        }
+    }
+    catch {
+        // Key doesn't exist or is unreadable — generate a new one
+    }
+    fs.mkdirSync(CACHE_DIR, { recursive: true, mode: 0o700 });
+    const key = crypto.randomBytes(32);
+    const tmpPath = `${KEY_PATH}.tmp.${process.pid}`;
+    fs.writeFileSync(tmpPath, key, { mode: 0o600 });
+    fs.renameSync(tmpPath, KEY_PATH);
+    return fs.readFileSync(KEY_PATH);
+}
+export function readCache(companyUid, name) {
+    if (!validateInputs(companyUid, name))
+        return null;
+    const filePath = path.join(CACHE_DIR, companyUid, name);
+    let raw;
+    try {
+        raw = fs.readFileSync(filePath);
+    }
+    catch {
+        return null;
+    }
+    // Format: [8 bytes timestamp][12 bytes IV][16 bytes authTag][...ciphertext]
+    const headerLen = 8 + IV_BYTES + AUTH_TAG_BYTES;
+    if (raw.length < headerLen)
+        return null;
+    const timestampMs = Number(raw.readBigInt64BE(0));
+    if (Date.now() - timestampMs > TTL_MS) {
+        try {
+            fs.unlinkSync(filePath);
+        }
+        catch { /* ok */ }
+        return null;
+    }
+    const iv = raw.subarray(8, 8 + IV_BYTES);
+    const authTag = raw.subarray(8 + IV_BYTES, headerLen);
+    const ciphertext = raw.subarray(headerLen);
+    let key;
+    try {
+        key = getOrCreateKey();
+    }
+    catch {
+        return null;
+    }
+    try {
+        const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+        decipher.setAuthTag(authTag);
+        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return decrypted.toString("utf8");
+    }
+    catch {
+        try {
+            fs.unlinkSync(filePath);
+        }
+        catch { /* ok */ }
+        return null;
+    }
+}
+export function writeCache(companyUid, name, value) {
+    try {
+        if (!validateInputs(companyUid, name))
+            return;
+        ensureCacheDir(companyUid);
+        const key = getOrCreateKey();
+        const iv = crypto.randomBytes(IV_BYTES);
+        const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+        const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        const timestamp = Buffer.alloc(8);
+        timestamp.writeBigInt64BE(BigInt(Date.now()));
+        const out = Buffer.concat([timestamp, iv, authTag, encrypted]);
+        const filePath = path.join(CACHE_DIR, companyUid, name);
+        const tmpPath = `${filePath}.tmp.${process.pid}`;
+        fs.writeFileSync(tmpPath, out, { mode: 0o600 });
+        fs.renameSync(tmpPath, filePath);
+    }
+    catch {
+        // Cache write failure is non-fatal
+    }
+}
+export function removeCacheEntry(companyUid, name) {
+    if (!validateInputs(companyUid, name))
+        return;
+    const filePath = path.join(CACHE_DIR, companyUid, name);
+    try {
+        fs.unlinkSync(filePath);
+    }
+    catch {
+        // Cache entry may not exist
+    }
+}
+export function clearAllCache() {
+    let removed = 0;
+    try {
+        fs.rmSync(CACHE_DIR, { recursive: true, force: true });
+        removed = 1;
+    }
+    catch {
+        // Cache dir may not exist
+    }
+    return { removed };
+}
+//# sourceMappingURL=secrets-cache.js.map

package/dist/utils/secrets-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-cache.js","sourceRoot":"","sources":["../../src/utils/secrets-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC9C,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC7C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB,EAAE,IAAY;IACtD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;YAChD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAY;IACxD,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,GAAG,cAAc,CAAC;IAChD,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,QAAQ,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE3C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,cAAc,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,IAAY,EAAE,KAAa;IACxE,IAAI,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC;YAAE,OAAO;QAC9C,cAAc,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACjD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAY;IAC/D,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC;QAAE,OAAO;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO,GAAG,CAAC,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.5.1",
+  "version": "5.5.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -10,20 +10,23 @@
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
     "clean": "rm -rf dist"
   },
   "dependencies": {
     "@indigoai-us/hq-cloud": "^5.1.0",
-    "@indigoai-us/hq-onboarding": "0.1.0",
+    "@indigoai-us/hq-onboarding": "^0.1.1",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
-    "simple-git": "^3.27.0"
+    "simple-git": "^3.27.0",
+    "semver": "^7.6.3"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "@types/semver": "^7.5.8"
   },
   "repository": {
     "type": "git",

package/src/commands/add.ts

@@ -4,7 +4,7 @@
 
 import { Command } from 'commander';
 import { findHqRoot, addModule, parseRepoName, isValidRepoUrl } from '../utils/manifest.js';
-import type { ModuleDefinition, SyncStrategy } from '../types.js';
+import type { LegacyModuleDefinition, LegacyStrategy } from '../types.js';
 
 export function registerAddCommand(program: Command): void {
   program
@@ -30,9 +30,10 @@ export function registerAddCommand(program: Command): void {
         // Parse name
         const name = options.as || parseRepoName(repoUrl);
 
-        // Validate strategy
-        const validStrategies: SyncStrategy[] = ['link', 'merge', 'copy'];
-        if (!validStrategies.includes(options.strategy as SyncStrategy)) {
+        // Validate strategy (hq modules add is for legacy git-repo modules;
+        // content packs are added via `hq install`, not `hq modules add`)
+        const validStrategies: LegacyStrategy[] = ['link', 'merge', 'copy'];
+        if (!validStrategies.includes(options.strategy as LegacyStrategy)) {
           console.error(`Error: Invalid strategy "${options.strategy}". Use: ${validStrategies.join(', ')}`);
           process.exit(1);
         }
@@ -48,11 +49,11 @@ export function registerAddCommand(program: Command): void {
             })
           : [{ src: '.', dest: `workers/${name}` }]; // Default: entire repo to workers/
 
-        const module: ModuleDefinition = {
+        const module: LegacyModuleDefinition = {
           name,
           repo: repoUrl,
           branch: options.branch,
-          strategy: options.strategy as SyncStrategy,
+          strategy: options.strategy as LegacyStrategy,
           paths,
         };
 

package/src/commands/auth.ts

@@ -12,9 +12,6 @@
  * into this machine by writing ~/.hq/cognito-tokens.json; once cached, the
  * session is kept fresh by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
- *
- * Note: the top-level `hq login` command authenticates against the HQ package
- * registry (Clerk), not Cognito — that is a different auth stack.
  */
 
 import { Command } from "commander";

package/src/commands/list.ts

@@ -29,10 +29,29 @@ export function registerListCommand(program: Command): void {
         console.log('Modules:\n');
 
         for (const module of manifest.modules) {
+          console.log(`  ${module.name}`);
+
+          if (module.strategy === 'package') {
+            // hq-pack content pack — wired by scripts/scan-packages.sh
+            console.log(`    Strategy: package`);
+            console.log(`    Source:   ${module.source}`);
+            if (module.version) {
+              console.log(`    Version:  ${module.version}`);
+            }
+            if (module.installed_at) {
+              console.log(`    Path:     ${module.installed_at}`);
+            }
+            if (module.resolved_sha) {
+              console.log(`    SHA:      ${module.resolved_sha}`);
+            }
+            console.log();
+            continue;
+          }
+
+          // legacy git-repo module
           const moduleDir = path.join(modulesDir, module.name);
           const installed = await isRepo(moduleDir);
 
-          console.log(`  ${module.name}`);
           console.log(`    Repo:     ${module.repo}`);
           console.log(`    Branch:   ${module.branch || 'main'}`);
           console.log(`    Strategy: ${module.strategy}`);

package/src/commands/login.ts

@@ -1,23 +1,42 @@
 /**
- * hq login — opens browser for Clerk auth, caches token (US-004)
+ * hq login — opens browser for Cognito auth via Google OAuth
  */
 
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { startAuthFlow } from '../utils/auth.js';
-import { saveToken } from '../utils/token-store.js';
-import { getRegistryUrl } from '../utils/registry-client.js';
+import { browserLogin, loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
+import { DEFAULT_COGNITO } from '../utils/cognito-session.js';
+
+function peekIdToken(idToken: string): { email?: string; sub?: string } {
+  try {
+    const payload = idToken.split('.')[1];
+    if (!payload) return {};
+    const pad = payload.length % 4 === 0 ? '' : '='.repeat(4 - (payload.length % 4));
+    const normalized = payload.replace(/-/g, '+').replace(/_/g, '/') + pad;
+    const decoded = JSON.parse(Buffer.from(normalized, 'base64').toString('utf-8'));
+    return { email: decoded.email, sub: decoded.sub };
+  } catch {
+    return {};
+  }
+}
 
 export function registerLoginCommand(program: Command): void {
   program
     .command('login')
-    .description('Authenticate with the HQ package registry')
+    .description('Authenticate with HQ via Cognito (Google OAuth)')
     .action(async () => {
       try {
-        const registryUrl = getRegistryUrl();
-        const token = await startAuthFlow(registryUrl);
-        await saveToken(token);
-        console.log(chalk.green(`Logged in as ${token.email}`));
+        const existing = loadCachedTokens();
+        if (existing && !isExpiring(existing, 120)) {
+          const who = peekIdToken(existing.idToken).email ?? 'cached session';
+          console.log(chalk.green(`Already logged in as ${who}. Run \`hq logout\` to switch accounts.`));
+          return;
+        }
+
+        console.log('Opening browser for authentication...');
+        const tokens = await browserLogin(DEFAULT_COGNITO);
+        const who = peekIdToken(tokens.idToken).email ?? 'HQ';
+        console.log(chalk.green(`Logged in as ${who}`));
       } catch (error) {
         console.error(
           chalk.red('Login failed:'),

package/src/commands/logout.ts

@@ -1,10 +1,10 @@
 /**
- * hq logout — clears cached session (US-004)
+ * hq logout — clears cached Cognito session
  */
 
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { clearToken } from '../utils/token-store.js';
+import { clearCachedTokens, loadCachedTokens } from '@indigoai-us/hq-cloud';
 
 export function registerLogoutCommand(program: Command): void {
   program
@@ -12,7 +12,12 @@ export function registerLogoutCommand(program: Command): void {
     .description('Log out and clear cached credentials')
     .action(async () => {
       try {
-        await clearToken();
+        const existing = loadCachedTokens();
+        if (!existing) {
+          console.log(chalk.yellow('No cached HQ session'));
+          return;
+        }
+        clearCachedTokens();
         console.log(chalk.green('Logged out successfully'));
       } catch (error) {
         console.error(