@indigoai-us/hq-cli 5.60.0 → 5.62.0

package/dist/utils/version-check.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="99545a82-414c-5fed-a478-ea8e63009643")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f7058fc6-251e-5e11-af6c-de15f6e256f3")}catch(e){}}();
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -9,10 +9,15 @@ import { CLI_VERSION } from "../cli-version.js";
 const PACKAGE_NAME = "@indigoai-us/hq-cli";
 const REGISTRY_URL = `https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME)}/latest`;
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const CACHE_TTL_JITTER_MS = 60 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 3_000;
+const REFRESH_LOCK_STALE_MS = 10 * 60 * 1000;
 function cachePath() {
     return path.join(os.homedir(), ".hq", "version-check.json");
 }
+function lockPath() {
+    return path.join(os.homedir(), ".hq", "version-check.lock");
+}
 function isOptedOut() {
     return process.env.HQ_NO_UPDATE_CHECK === "1";
 }
@@ -40,6 +45,59 @@ function writeCache(entry) {
         // best-effort; never break the CLI on cache write failure
     }
 }
+function freshEnough(entry, now = Date.now()) {
+    const jitter = Math.floor(Math.random() * CACHE_TTL_JITTER_MS);
+    return now - entry.fetchedAt <= CACHE_TTL_MS - jitter;
+}
+function isKnownNoninteractiveStatusProbe(argv = process.argv) {
+    const args = argv.slice(2);
+    const positional = args.filter((arg) => !arg.startsWith("-"));
+    const json = args.includes("--json") || !process.stdout.isTTY;
+    if (!json)
+        return false;
+    if (positional[0] === "mcp" && positional[1] === "status")
+        return true;
+    if (positional[0] === "packs" && (positional[1] === "list" || positional[1] === "ls"))
+        return true;
+    if (positional[0] === "packages" &&
+        positional[1] === "packs" &&
+        (positional[2] === "list" || positional[2] === "ls")) {
+        return true;
+    }
+    if ((positional[0] === "sources" || positional[0] === "signals") && positional[1] === "list") {
+        return true;
+    }
+    return false;
+}
+function acquireRefreshLock(now = Date.now()) {
+    const dir = lockPath();
+    try {
+        fs.mkdirSync(path.dirname(dir), { recursive: true });
+        fs.mkdirSync(dir);
+        fs.writeFileSync(path.join(dir, "owner"), `${process.pid}\n${now}\n`);
+        return () => {
+            try {
+                fs.rmSync(dir, { recursive: true, force: true });
+            }
+            catch {
+                // best-effort lock cleanup
+            }
+        };
+    }
+    catch {
+        try {
+            const stat = fs.statSync(dir);
+            if (now - stat.mtimeMs > REFRESH_LOCK_STALE_MS) {
+                fs.rmSync(dir, { recursive: true, force: true });
+                return acquireRefreshLock(now);
+            }
+        }
+        catch {
+            // ignore lock inspection failures
+        }
+        return null;
+    }
+}
 export function maybeWarnNewVersion() {
     if (isOptedOut())
         return;
@@ -60,7 +118,18 @@ export function maybeWarnNewVersion() {
 export async function refreshVersionCache() {
     if (isOptedOut())
         return;
+    if (isKnownNoninteractiveStatusProbe())
+        return;
+    const existing = readCache();
+    if (existing && freshEnough(existing))
+        return;
+    const releaseLock = acquireRefreshLock();
+    if (!releaseLock)
+        return;
     try {
+        const lockedExisting = readCache();
+        if (lockedExisting && freshEnough(lockedExisting))
+            return;
         const res = await fetch(REGISTRY_URL, {
             headers: { Accept: "application/json" },
             signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
@@ -75,6 +144,13 @@ export async function refreshVersionCache() {
     catch {
         // best-effort; offline / registry down / timeout — silent
     }
+    finally {
+        releaseLock();
+    }
 }
+export const __test__ = {
+    CACHE_TTL_MS,
+    isKnownNoninteractiveStatusProbe,
+};
 //# sourceMappingURL=version-check.js.map
-//# debugId=99545a82-414c-5fed-a478-ea8e63009643
+//# debugId=f7058fc6-251e-5e11-af6c-de15f6e256f3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.60.0",
+  "version": "5.62.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -12,6 +12,7 @@
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
     "test": "vitest run",
+    "test:db": "vitest run src/lib/db test/commands/db.test.ts test/commands/db-tenant-isolation.test.ts",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",
     "vitest": "vitest",
@@ -21,6 +22,7 @@
     "@indigoai-us/hq-cloud": "^6.12.1",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
+    "better-sqlite3": "^12.11.1",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
@@ -33,6 +35,7 @@
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.1049.0",
     "@eslint/js": "^10.0.1",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
     "@types/semver": "^7.5.8",
@@ -58,5 +61,10 @@
   "type": "module",
   "engines": {
     "node": ">=20.0.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3"
+    ]
   }
 }

package/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+allowBuilds:
+  better-sqlite3: true

package/src/commands/agents.test.ts

@@ -0,0 +1,297 @@
+/**
+ * Unit tests for `hq agents` (agents.ts).
+ *
+ * Mirrors company.test.ts / members.test.ts: mock ensureCognitoToken +
+ * getCompanyUid, spy on global fetch, drive through a Commander program, and
+ * assert the /v1/agents request shape (method + path + body) plus the guard /
+ * validation / exit behavior. `vaultApiFetch` itself is NOT mocked — the spied
+ * global fetch verifies the real URL + init the helper produces.
+ */
+
+import { Command } from "commander";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+
+vi.mock("../utils/cognito-session.js", async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import("../utils/cognito-session.js")>();
+  return {
+    ...original,
+    ensureCognitoToken: vi.fn(async () => "test-token"),
+  };
+});
+
+vi.mock("../utils/vault-api.js", async (importOriginal) => {
+  const original = await importOriginal<typeof import("../utils/vault-api.js")>();
+  return {
+    ...original,
+    getCompanyUid: vi.fn(async () => "cmp_acme"),
+  };
+});
+
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { getCompanyUid } from "../utils/vault-api.js";
+import { registerAgentsCommand } from "./agents.js";
+
+function jsonResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+let fetchSpy: MockInstance<typeof fetch>;
+let exitSpy: MockInstance<typeof process.exit>;
+let logSpy: MockInstance<typeof console.log>;
+const mockEnsureCognitoToken = vi.mocked(ensureCognitoToken);
+const mockGetCompanyUid = vi.mocked(getCompanyUid);
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  fetchSpy = vi.spyOn(globalThis, "fetch");
+  mockEnsureCognitoToken.mockResolvedValue("test-token");
+  mockGetCompanyUid.mockResolvedValue("cmp_acme");
+  exitSpy = vi.spyOn(process, "exit").mockImplementation((code?: number) => {
+    throw new Error(`process.exit(${code})`);
+  }) as unknown as MockInstance<typeof process.exit>;
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+  vi.spyOn(console, "error").mockImplementation(() => {});
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.name("hq").exitOverride();
+  registerAgentsCommand(program);
+  return program;
+}
+
+async function run(args: string[]): Promise<void> {
+  await buildProgram().parseAsync(["node", "hq", ...args]);
+}
+
+describe("hq agents list", () => {
+  it("GETs /v1/agents with the resolved companyUid", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        agents: [
+          { uid: "agt_1", name: "Ops", slug: "ops", agentStatus: "running" },
+        ],
+      }),
+    );
+
+    await run(["agents", "--company", "acme", "list"]);
+
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/v1/agents");
+    expect(String(url)).toContain("companyUid=cmp_acme");
+    expect(init?.method ?? "GET").toBe("GET");
+  });
+
+  it("accepts --company on the subcommand too", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { agents: [] }));
+    await run(["agents", "list", "--company", "acme"]);
+    expect(mockGetCompanyUid).toHaveBeenCalledWith("test-token", "acme");
+  });
+
+  it("emits raw JSON with --json", async () => {
+    const stdoutSpy = vi
+      .spyOn(process.stdout, "write")
+      .mockImplementation(() => true);
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { agents: [{ uid: "agt_1", name: "Ops", slug: "ops" }] }),
+    );
+    await run(["agents", "--company", "acme", "list", "--json"]);
+    const printed = stdoutSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(printed).toContain('"uid": "agt_1"');
+  });
+
+  it("prints a friendly message when agents are not enabled (404)", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(404, { error: "not found" }));
+    await run(["agents", "--company", "acme", "list"]);
+    const printed = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(printed).toMatch(/agents feature isn't enabled/i);
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe("hq agents rename", () => {
+  it("PATCHes the profile with displayName", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        uid: "agt_1",
+        profile: { displayName: "New" },
+        slackUpdated: false,
+      }),
+    );
+
+    await run(["agents", "--company", "acme", "rename", "agt_1", "New"]);
+
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/v1/agents/agt_1/profile");
+    expect(init?.method).toBe("PATCH");
+    expect(JSON.parse(init?.body as string)).toEqual({ displayName: "New" });
+  });
+});
+
+describe("hq agents set", () => {
+  it("PATCHes only the supplied profile fields", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { uid: "agt_1", profile: {}, slackUpdated: true }),
+    );
+
+    await run([
+      "agents",
+      "--company",
+      "acme",
+      "set",
+      "agt_1",
+      "--title",
+      "Chief of Staff",
+    ]);
+
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/v1/agents/agt_1/profile");
+    expect(init?.method).toBe("PATCH");
+    const sent = JSON.parse(init?.body as string);
+    expect(sent).toEqual({ title: "Chief of Staff" });
+  });
+
+  it("requires at least one field", async () => {
+    await expect(
+      run(["agents", "--company", "acme", "set", "agt_1"]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe("hq agents config", () => {
+  it("PATCHes runtime-config with model/effort/tier", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { uid: "agt_1", codexModel: "gpt-5.5", applied: true }),
+    );
+
+    await run([
+      "agents",
+      "--company",
+      "acme",
+      "config",
+      "agt_1",
+      "--model",
+      "gpt-5.5",
+      "--effort",
+      "high",
+      "--tier",
+      "priority",
+    ]);
+
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/v1/agents/agt_1/runtime-config");
+    expect(init?.method).toBe("PATCH");
+    expect(JSON.parse(init?.body as string)).toEqual({
+      codexModel: "gpt-5.5",
+      codexReasoningEffort: "high",
+      codexServiceTier: "priority",
+    });
+  });
+
+  it("rejects an invalid --effort", async () => {
+    await expect(
+      run([
+        "agents",
+        "--company",
+        "acme",
+        "config",
+        "agt_1",
+        "--effort",
+        "turbo",
+      ]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("rejects an invalid --tier", async () => {
+    await expect(
+      run([
+        "agents",
+        "--company",
+        "acme",
+        "config",
+        "agt_1",
+        "--tier",
+        "turbo",
+      ]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("requires at least one field", async () => {
+    await expect(
+      run(["agents", "--company", "acme", "config", "agt_1"]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe("hq agents start/stop/retry", () => {
+  it("POSTs /start", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { uid: "agt_1" }));
+    await run(["agents", "--company", "acme", "start", "agt_1"]);
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/v1/agents/agt_1/start");
+    expect(init?.method).toBe("POST");
+  });
+
+  it("POSTs /stop", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { uid: "agt_1" }));
+    await run(["agents", "--company", "acme", "stop", "agt_1"]);
+    expect(String(fetchSpy.mock.calls[0][0])).toContain("/v1/agents/agt_1/stop");
+  });
+
+  it("POSTs /retry", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { uid: "agt_1" }));
+    await run(["agents", "--company", "acme", "retry", "agt_1"]);
+    expect(String(fetchSpy.mock.calls[0][0])).toContain("/v1/agents/agt_1/retry");
+  });
+});
+
+describe("hq agents rm", () => {
+  it("refuses without --yes and does not call the API", async () => {
+    await expect(
+      run(["agents", "--company", "acme", "rm", "agt_1"]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("DELETEs the agent with --yes", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { uid: "agt_1", terminal: true }),
+    );
+    await run(["agents", "--company", "acme", "rm", "agt_1", "--yes"]);
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/v1/agents/agt_1");
+    expect(init?.method).toBe("DELETE");
+  });
+});
+
+describe("hq agents status", () => {
+  it("exits 1 on a non-2xx and surfaces the error", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(403, { error: "forbidden" }),
+    );
+    await expect(
+      run(["agents", "--company", "acme", "status", "agt_1"]),
+    ).rejects.toThrow("process.exit(1)");
+  });
+});