@indigoai-us/hq-cli 5.60.0 → 5.62.0

package/src/utils/version-check.ts

@@ -8,7 +8,9 @@ import { CLI_VERSION } from "../cli-version.js";
 const PACKAGE_NAME = "@indigoai-us/hq-cli";
 const REGISTRY_URL = `https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME)}/latest`;
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const CACHE_TTL_JITTER_MS = 60 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 3_000;
+const REFRESH_LOCK_STALE_MS = 10 * 60 * 1000;
 
 interface CacheEntry {
   latest: string;
@@ -19,6 +21,10 @@ function cachePath(): string {
   return path.join(os.homedir(), ".hq", "version-check.json");
 }
 
+function lockPath(): string {
+  return path.join(os.homedir(), ".hq", "version-check.lock");
+}
+
 function isOptedOut(): boolean {
   return process.env.HQ_NO_UPDATE_CHECK === "1";
 }
@@ -49,6 +55,58 @@ function writeCache(entry: CacheEntry): void {
   }
 }
 
+function freshEnough(entry: CacheEntry, now = Date.now()): boolean {
+  const jitter = Math.floor(Math.random() * CACHE_TTL_JITTER_MS);
+  return now - entry.fetchedAt <= CACHE_TTL_MS - jitter;
+}
+
+function isKnownNoninteractiveStatusProbe(argv: readonly string[] = process.argv): boolean {
+  const args = argv.slice(2);
+  const positional = args.filter((arg) => !arg.startsWith("-"));
+  const json = args.includes("--json") || !process.stdout.isTTY;
+  if (!json) return false;
+  if (positional[0] === "mcp" && positional[1] === "status") return true;
+  if (positional[0] === "packs" && (positional[1] === "list" || positional[1] === "ls")) return true;
+  if (
+    positional[0] === "packages" &&
+    positional[1] === "packs" &&
+    (positional[2] === "list" || positional[2] === "ls")
+  ) {
+    return true;
+  }
+  if ((positional[0] === "sources" || positional[0] === "signals") && positional[1] === "list") {
+    return true;
+  }
+  return false;
+}
+
+function acquireRefreshLock(now = Date.now()): (() => void) | null {
+  const dir = lockPath();
+  try {
+    fs.mkdirSync(path.dirname(dir), { recursive: true });
+    fs.mkdirSync(dir);
+    fs.writeFileSync(path.join(dir, "owner"), `${process.pid}\n${now}\n`);
+    return () => {
+      try {
+        fs.rmSync(dir, { recursive: true, force: true });
+      } catch {
+        // best-effort lock cleanup
+      }
+    };
+  } catch {
+    try {
+      const stat = fs.statSync(dir);
+      if (now - stat.mtimeMs > REFRESH_LOCK_STALE_MS) {
+        fs.rmSync(dir, { recursive: true, force: true });
+        return acquireRefreshLock(now);
+      }
+    } catch {
+      // ignore lock inspection failures
+    }
+    return null;
+  }
+}
+
 export function maybeWarnNewVersion(): void {
   if (isOptedOut()) return;
   const entry = readCache();
@@ -68,7 +126,14 @@ export function maybeWarnNewVersion(): void {
 
 export async function refreshVersionCache(): Promise<void> {
   if (isOptedOut()) return;
+  if (isKnownNoninteractiveStatusProbe()) return;
+  const existing = readCache();
+  if (existing && freshEnough(existing)) return;
+  const releaseLock = acquireRefreshLock();
+  if (!releaseLock) return;
   try {
+    const lockedExisting = readCache();
+    if (lockedExisting && freshEnough(lockedExisting)) return;
     const res = await fetch(REGISTRY_URL, {
       headers: { Accept: "application/json" },
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
@@ -79,5 +144,12 @@ export async function refreshVersionCache(): Promise<void> {
     writeCache({ latest: body.version, fetchedAt: Date.now() });
   } catch {
     // best-effort; offline / registry down / timeout — silent
+  } finally {
+    releaseLock();
   }
 }
+
+export const __test__ = {
+  CACHE_TTL_MS,
+  isKnownNoninteractiveStatusProbe,
+};

package/test/commands/db-tenant-isolation.test.ts

@@ -0,0 +1,94 @@
+/**
+ * Tenant isolation regression suite (US-011) — CLI + control-plane client side.
+ *
+ * API matrix lives primarily in hq-pro; this suite asserts CLI path denial and
+ * secret-ref namespacing expectations.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { ControlPlaneDbClient } from "../../src/lib/db/control-plane.js";
+import { openLocalDb } from "../../src/lib/db/local.js";
+import { resolveLocalDbPath } from "../../src/lib/db/paths.js";
+import { runLocalSql } from "../../src/lib/db/sql.js";
+
+const temps: string[] = [];
+
+afterEach(() => {
+  while (temps.length) {
+    const d = temps.pop();
+    if (d) fs.rmSync(d, { recursive: true, force: true });
+  }
+});
+
+describe("tenant isolation (local + remote client)", () => {
+  it("company A cannot open company B local path by override", () => {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), "hq-db-iso-"));
+    temps.push(home);
+    openLocalDb("alpha", { home }).close();
+    openLocalDb("beta", { home }).close();
+    const betaPath = resolveLocalDbPath("beta", { home });
+
+    expect(() =>
+      runLocalSql({
+        company: "alpha",
+        home,
+        sql: "SELECT 1",
+        dbPathOverride: betaPath,
+      }),
+    ).toThrow(/denied/i);
+  });
+
+  it("Y cannot provision X via control plane (403)", async () => {
+    const fetchImpl = vi.fn(async () => {
+      return new Response(JSON.stringify({ error: "Forbidden" }), {
+        status: 403,
+      });
+    }) as unknown as typeof fetch;
+
+    const client = new ControlPlaneDbClient({
+      baseUrl: "https://api.example",
+      getAccessToken: async () => "tok-y",
+      fetchImpl,
+    });
+
+    await expect(
+      client.provision({ companyUid: "cmp_x", companySlug: "x" }),
+    ).rejects.toMatchObject({ status: 403 });
+  });
+
+  it("secret refs are company-namespaced", async () => {
+    const fetchImpl = vi.fn(async () => {
+      return new Response(
+        JSON.stringify({
+          ok: true,
+          companyUid: "cmp_x",
+          companySlug: "x",
+          engineId: "aurora-dsql",
+          resourceArn: "arn:aws:dsql:us-east-1:1:cluster/x",
+          region: "us-east-1",
+          status: "ready",
+          secretRef: "ssm:/hq/cmp_x/secrets/DB/REMOTE/X",
+          idempotent: false,
+        }),
+        { status: 200 },
+      );
+    }) as unknown as typeof fetch;
+
+    const client = new ControlPlaneDbClient({
+      baseUrl: "https://api.example",
+      getAccessToken: async () => "tok",
+      fetchImpl,
+    });
+    const result = await client.provision({
+      companyUid: "cmp_x",
+      companySlug: "x",
+    });
+    expect(result.secretRef).toContain("cmp_x");
+    expect(result.secretRef).not.toContain("cmp_y");
+  });
+});

package/test/commands/db.test.ts

@@ -0,0 +1,85 @@
+/**
+ * C1 local `hq db` harness (vault-databases US-006).
+ *
+ * Offline only: temp HOME + temp HQ root, zero network.
+ * Covers path resolution, status auto-create, sql select, migrate apply/idempotent.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { ensureAndStatusLocalDb } from "../../src/lib/db/local.js";
+import { migrateLocalDb } from "../../src/lib/db/migrate.js";
+import { resolveLocalDbPath } from "../../src/lib/db/paths.js";
+import { runLocalSql } from "../../src/lib/db/sql.js";
+
+const temps: string[] = [];
+
+function fixture(): { home: string; hqRoot: string } {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-db-harness-"));
+  temps.push(root);
+  const home = path.join(root, "home");
+  const hqRoot = path.join(root, "hq");
+  fs.mkdirSync(home, { recursive: true });
+  fs.mkdirSync(hqRoot, { recursive: true });
+  return { home, hqRoot };
+}
+
+afterEach(() => {
+  while (temps.length > 0) {
+    const d = temps.pop();
+    if (d) fs.rmSync(d, { recursive: true, force: true });
+  }
+});
+
+describe("hq db C1 harness (offline)", () => {
+  it("path resolution for two company slugs under documented root", () => {
+    const { home } = fixture();
+    const a = resolveLocalDbPath("indigo", { home });
+    const b = resolveLocalDbPath("acme", { home });
+    expect(a).toContain(path.join(".hq", "db", "indigo", "vault.db"));
+    expect(b).toContain(path.join(".hq", "db", "acme", "vault.db"));
+    expect(a).not.toBe(b);
+  });
+
+  it("status auto-creates WAL SQLite and reopen is stable", () => {
+    const { home } = fixture();
+    const first = ensureAndStatusLocalDb("fixture", { home });
+    expect(first.healthy).toBe(true);
+    expect(first.journalMode?.toLowerCase()).toBe("wal");
+    expect(fs.existsSync(first.path)).toBe(true);
+
+    const size1 = fs.statSync(first.path).size;
+    const second = ensureAndStatusLocalDb("fixture", { home });
+    expect(second.healthy).toBe(true);
+    expect(fs.statSync(second.path).size).toBeGreaterThanOrEqual(size1);
+  });
+
+  it("sql select after migrate smoke table", () => {
+    const { home, hqRoot } = fixture();
+    const migDir = path.join(hqRoot, "companies", "fixture", "db", "migrations");
+    fs.mkdirSync(migDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(migDir, "001_smoke.sql"),
+      "CREATE TABLE smoke (id INTEGER PRIMARY KEY, v TEXT);\nINSERT INTO smoke (v) VALUES ('ok');\n",
+      "utf8",
+    );
+
+    const mig = migrateLocalDb({ company: "fixture", home, hqRoot });
+    expect(mig.applied).toContain("001_smoke.sql");
+
+    const rows = runLocalSql({
+      company: "fixture",
+      home,
+      sql: "SELECT v FROM smoke",
+    });
+    expect(rows.rows[0]).toMatchObject({ v: "ok" });
+
+    const again = migrateLocalDb({ company: "fixture", home, hqRoot });
+    expect(again.applied).toEqual([]);
+    expect(again.skipped.length).toBeGreaterThan(0);
+  });
+});