@indigoai-us/hq-cli 5.61.0 → 5.62.0

package/src/lib/db/sql.ts

@@ -0,0 +1,192 @@
+/**
+ * Local SQL execution helpers (vault-databases US-004).
+ *
+ * Company scope is path-bound via resolveLocalDbPath — callers must pass the
+ * resolved company slug from HQ session/flags. Path overrides that open
+ * another company's DB are denied unless an explicit dangerous flag is set.
+ */
+
+import Database from "better-sqlite3";
+
+import type { LocalDb } from "./local.js";
+import { openLocalDb } from "./local.js";
+import {
+  normalizeCompanySlugForLocalDb,
+  resolveLocalDbDir,
+  resolveLocalDbPath,
+  type LocalDbPathEnv,
+} from "./paths.js";
+
+export interface SqlRunOptions extends LocalDbPathEnv {
+  company: string;
+  sql: string;
+  /** Allow INSERT/UPDATE/DELETE/DDL. Default false (read-only). */
+  write?: boolean;
+  /**
+   * Dangerous: open an absolute DB path instead of the company canonical path.
+   * Denied unless allowCrossCompanyPath is true.
+   */
+  dbPathOverride?: string;
+  /** Explicit dangerous flag to open a non-canonical local DB path. Default false. */
+  allowCrossCompanyPath?: boolean;
+  /** Output format */
+  format?: "jsonl" | "table";
+}
+
+export interface SqlRunResult {
+  columns: string[];
+  rows: Record<string, unknown>[];
+  changes: number;
+  readonly: boolean;
+}
+
+const WRITE_PATTERN =
+  /^\s*(INSERT|UPDATE|DELETE|REPLACE|CREATE|DROP|ALTER|TRUNCATE|REINDEX|VACUUM|BEGIN|COMMIT|ROLLBACK)\b/i;
+
+/** Always forbidden — opens other files/DBs and breaks company path isolation. */
+const FORBIDDEN_SQL_PATTERN =
+  /\b(ATTACH|DETACH|LOAD_EXTENSION)\b/i;
+
+export function stripSqlNoise(sql: string): string {
+  return sql
+    .replace(/^\s*--[^\n]*\n/gm, "")
+    .replace(/^\s*\/\*[\s\S]*?\*\//gm, "")
+    .trim();
+}
+
+export function isWriteSql(sql: string): boolean {
+  return WRITE_PATTERN.test(stripSqlNoise(sql));
+}
+
+/**
+ * Statements that must never run via `hq db sql`, even with --write.
+ * ATTACH/DETACH would let a company-scoped session open another company's
+ * vault.db by absolute path (category-1 isolation).
+ */
+export function assertSqlAllowed(sql: string): void {
+  const stripped = stripSqlNoise(sql);
+  if (FORBIDDEN_SQL_PATTERN.test(stripped)) {
+    throw new Error(
+      "ATTACH/DETACH/LOAD_EXTENSION are not allowed via hq db sql (tenant isolation); use the company-canonical local path only",
+    );
+  }
+}
+
+/**
+ * Resolve which file path to open, enforcing company isolation by default.
+ */
+export function resolveSqlDbPath(opts: SqlRunOptions): string {
+  const company = normalizeCompanySlugForLocalDb(opts.company);
+  const canonical = resolveLocalDbPath(company, opts);
+
+  if (!opts.dbPathOverride) {
+    return canonical;
+  }
+
+  if (opts.dbPathOverride === canonical) {
+    return canonical;
+  }
+
+  if (!opts.allowCrossCompanyPath) {
+    throw new Error(
+      "cross-company or path override denied: refusing to open a non-canonical local DB path without --allow-cross-company-path (dangerous)",
+    );
+  }
+
+  return opts.dbPathOverride;
+}
+
+function openByPath(dbPath: string): LocalDb {
+  const db = new Database(dbPath);
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+  return db;
+}
+
+/**
+ * Execute SQL against the company local vault DB.
+ */
+export function runLocalSql(opts: SqlRunOptions): SqlRunResult {
+  const sql = opts.sql?.trim();
+  if (!sql) {
+    throw new Error("SQL statement is required");
+  }
+
+  assertSqlAllowed(sql);
+
+  const writeRequested = !!opts.write;
+  if (isWriteSql(sql) && !writeRequested) {
+    throw new Error(
+      "write/DDL statement blocked in read-only mode; pass --write to allow (prefer hq db migrate for schema changes)",
+    );
+  }
+
+  const dbPath = resolveSqlDbPath(opts);
+  const usingCanonical =
+    !opts.dbPathOverride || opts.dbPathOverride === resolveLocalDbPath(opts.company, opts);
+
+  const db: LocalDb = usingCanonical
+    ? openLocalDb(opts.company, opts)
+    : openByPath(dbPath);
+
+  try {
+    if (!writeRequested) {
+      db.pragma("query_only = ON");
+    }
+
+    const stmt = db.prepare(sql);
+    if (stmt.reader) {
+      const rows = stmt.all() as Record<string, unknown>[];
+      const columns =
+        rows.length > 0
+          ? Object.keys(rows[0] as object)
+          : stmt.columns().map((c) => c.name);
+      return {
+        columns,
+        rows,
+        changes: 0,
+        readonly: !writeRequested,
+      };
+    }
+
+    const info = stmt.run();
+    return {
+      columns: ["changes", "lastInsertRowid"],
+      rows: [
+        {
+          changes: info.changes,
+          lastInsertRowid: Number(info.lastInsertRowid),
+        },
+      ],
+      changes: info.changes,
+      readonly: !writeRequested,
+    };
+  } finally {
+    db.close();
+  }
+}
+
+export function formatSqlResult(
+  result: SqlRunResult,
+  format: "jsonl" | "table" = "jsonl",
+): string {
+  if (format === "jsonl") {
+    if (result.rows.length === 0) {
+      return JSON.stringify({ columns: result.columns, rows: 0 });
+    }
+    return result.rows.map((r) => JSON.stringify(r)).join("\n");
+  }
+
+  const cols = result.columns;
+  if (cols.length === 0) return "(no columns)";
+  const header = cols.join("\t");
+  const body = result.rows
+    .map((r) => cols.map((c) => String(r[c] ?? "")).join("\t"))
+    .join("\n");
+  return body ? `${header}\n${body}` : header;
+}
+
+/** Test helper: company dir for isolation assertions. */
+export function companyLocalDbDir(company: string, env?: LocalDbPathEnv): string {
+  return resolveLocalDbDir(company, env);
+}

package/src/main.ts

@@ -35,9 +35,11 @@ import { registerApiKeysCommand } from "./commands/api-keys.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
 import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
+import { registerWorkersCommand } from "./commands/workers.js";
 import { registerGroupGrantsCommand } from "./commands/group-grants.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerFilesBrowseCommands } from "./commands/files-browse.js";
+import { registerSkillCommand } from "./commands/skill.js";
 import { registerMembersCommand } from "./commands/members.js";
 import { registerPeopleCommand } from "./commands/people.js";
 import { registerDmCommand } from "./commands/dm.js";
@@ -46,11 +48,15 @@ import { registerFeedbackCommand } from "./commands/feedback.js";
 import { registerMeetingsCommand } from "./commands/meetings.js";
 import { registerSourcesCommand } from "./commands/sources.js";
 import { registerSignalsCommand } from "./commands/signals.js";
+import { registerIntegrationsCommand } from "./commands/integrations.js";
 import { registerReindexCommand } from "./commands/reindex.js";
 import { registerRescueCommand } from "./commands/rescue.js";
 import { registerMcpCommand } from "./commands/mcp-status.js";
 import { registerCrmCommand } from "./commands/crm.js";
 import { registerCompanyCommand } from "./commands/company.js";
+import { registerAgentsCommand } from "./commands/agents.js";
+import { registerOutpostsCommand } from "./commands/outposts.js";
+import { registerDbCommand } from "./commands/db.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { isEpipe } from "./utils/epipe.js";
@@ -160,6 +166,9 @@ registerAuthCommands(program);
 // Secrets management (subcommand group — hq secrets set|get|list|delete|exec|generate-link|cache)
 registerSecretsCommand(program);
 
+// Vault databases (subcommand group — hq db status|sql|migrate|provision)
+registerDbCommand(program);
+
 // API key management (subcommand group — hq api-keys create|list|revoke)
 registerApiKeysCommand(program);
 
@@ -169,6 +178,9 @@ registerRunCommand(program);
 // Groups management (subcommand group — hq groups create|delete|add|remove|list|members)
 registerGroupsCommand(program);
 
+// Worker discovery + sharing (subcommand group — hq workers list|share)
+registerWorkersCommand(program);
+
 // Cross-company group grants (subcommand group —
 // hq group-grants grant|revoke|outbound|inbound)
 registerGroupGrantsCommand(program);
@@ -179,6 +191,11 @@ registerGroupGrantsCommand(program);
 const filesCmd = registerFilesCommand(program);
 registerFilesBrowseCommands(filesCmd);
 
+// Skill collaboration loop (subcommand group — hq skill suggest|list-suggestions|review).
+// A thin terminal front-end over the SAME wired hq-pro skill suggestion + merge
+// routes the MCP (US-007) and console merge (US-009) surfaces use — no forked logic.
+registerSkillCommand(program);
+
 // Membership management (subcommand group — hq members invite|list|revoke)
 registerMembersCommand(program);
 // People directory (subcommand group — hq people list|search|resolve), reading
@@ -202,6 +219,10 @@ registerSourcesCommand(program);
 // Signals read surface (subcommand group — hq signals list|get|types|entities)
 registerSignalsCommand(program);
 
+// Company-connected apps via the governed integration gateway
+// (subcommand group — hq integrations list|tools|call|approve|reject)
+registerIntegrationsCommand(program);
+
 // Skill/personal-overlay mirroring + workers-registry regen. Invoked by the
 // hq-core reindex hook shim (Stop / PostToolUse) and by sync()/rescue() after
 // they change on-disk sources. Keeps a `master-sync` alias for one release.
@@ -227,6 +248,16 @@ registerCrmCommand(program);
 // toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
 registerCompanyCommand(program);
 
+// Cloud agent management (subcommand group — `hq agents …`). Rename, reconfigure,
+// start/stop, and tear down a company's fleet agents via the hq-pro /v1/agents
+// control plane — the same routes the web console's agents panel calls.
+registerAgentsCommand(program);
+
+// Personal Outpost management (subcommand group — `hq outposts …`). List, inspect,
+// enable Codex on, refresh login for, and destroy your EC2 boxes via the hq-pro
+// /outpost/* control plane.
+registerOutpostsCommand(program);
+
 export async function runCli(): Promise<void> {
   try {
     Sentry.addBreadcrumb({

package/src/utils/cognito-session.ts

@@ -57,7 +57,7 @@ export const DEFAULT_COGNITO: CognitoAuthConfig = {
 };
 
 export const DEFAULT_VAULT_API_URL =
-  process.env.HQ_VAULT_API_URL ?? "https://hqapi.getindigo.ai";
+  process.env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
 
 /**
  * Resolve the HQ tree root for cloud-aware subcommands (`hq sync`, `hq onboard`,

package/src/utils/sandbox-runner-client.ts

@@ -38,7 +38,7 @@ export interface SandboxRunnerRetryOptions {
   maxDelayMs?: number;
 }
 
-const DEFAULT_SANDBOX_RUNNER_URL = "https://hqapi.getindigo.ai/sandbox";
+const DEFAULT_SANDBOX_RUNNER_URL = "https://hqapi.hq.computer/sandbox";
 const RETRYABLE_STATUS_CODES = new Set([408, 425, 429, 500, 502, 503, 504]);
 const DEFAULT_RETRY_OPTIONS: Required<SandboxRunnerRetryOptions> = {
   maxAttempts: 8,

package/test/commands/db-tenant-isolation.test.ts

@@ -0,0 +1,94 @@
+/**
+ * Tenant isolation regression suite (US-011) — CLI + control-plane client side.
+ *
+ * API matrix lives primarily in hq-pro; this suite asserts CLI path denial and
+ * secret-ref namespacing expectations.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { ControlPlaneDbClient } from "../../src/lib/db/control-plane.js";
+import { openLocalDb } from "../../src/lib/db/local.js";
+import { resolveLocalDbPath } from "../../src/lib/db/paths.js";
+import { runLocalSql } from "../../src/lib/db/sql.js";
+
+const temps: string[] = [];
+
+afterEach(() => {
+  while (temps.length) {
+    const d = temps.pop();
+    if (d) fs.rmSync(d, { recursive: true, force: true });
+  }
+});
+
+describe("tenant isolation (local + remote client)", () => {
+  it("company A cannot open company B local path by override", () => {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), "hq-db-iso-"));
+    temps.push(home);
+    openLocalDb("alpha", { home }).close();
+    openLocalDb("beta", { home }).close();
+    const betaPath = resolveLocalDbPath("beta", { home });
+
+    expect(() =>
+      runLocalSql({
+        company: "alpha",
+        home,
+        sql: "SELECT 1",
+        dbPathOverride: betaPath,
+      }),
+    ).toThrow(/denied/i);
+  });
+
+  it("Y cannot provision X via control plane (403)", async () => {
+    const fetchImpl = vi.fn(async () => {
+      return new Response(JSON.stringify({ error: "Forbidden" }), {
+        status: 403,
+      });
+    }) as unknown as typeof fetch;
+
+    const client = new ControlPlaneDbClient({
+      baseUrl: "https://api.example",
+      getAccessToken: async () => "tok-y",
+      fetchImpl,
+    });
+
+    await expect(
+      client.provision({ companyUid: "cmp_x", companySlug: "x" }),
+    ).rejects.toMatchObject({ status: 403 });
+  });
+
+  it("secret refs are company-namespaced", async () => {
+    const fetchImpl = vi.fn(async () => {
+      return new Response(
+        JSON.stringify({
+          ok: true,
+          companyUid: "cmp_x",
+          companySlug: "x",
+          engineId: "aurora-dsql",
+          resourceArn: "arn:aws:dsql:us-east-1:1:cluster/x",
+          region: "us-east-1",
+          status: "ready",
+          secretRef: "ssm:/hq/cmp_x/secrets/DB/REMOTE/X",
+          idempotent: false,
+        }),
+        { status: 200 },
+      );
+    }) as unknown as typeof fetch;
+
+    const client = new ControlPlaneDbClient({
+      baseUrl: "https://api.example",
+      getAccessToken: async () => "tok",
+      fetchImpl,
+    });
+    const result = await client.provision({
+      companyUid: "cmp_x",
+      companySlug: "x",
+    });
+    expect(result.secretRef).toContain("cmp_x");
+    expect(result.secretRef).not.toContain("cmp_y");
+  });
+});

package/test/commands/db.test.ts

@@ -0,0 +1,85 @@
+/**
+ * C1 local `hq db` harness (vault-databases US-006).
+ *
+ * Offline only: temp HOME + temp HQ root, zero network.
+ * Covers path resolution, status auto-create, sql select, migrate apply/idempotent.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { ensureAndStatusLocalDb } from "../../src/lib/db/local.js";
+import { migrateLocalDb } from "../../src/lib/db/migrate.js";
+import { resolveLocalDbPath } from "../../src/lib/db/paths.js";
+import { runLocalSql } from "../../src/lib/db/sql.js";
+
+const temps: string[] = [];
+
+function fixture(): { home: string; hqRoot: string } {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-db-harness-"));
+  temps.push(root);
+  const home = path.join(root, "home");
+  const hqRoot = path.join(root, "hq");
+  fs.mkdirSync(home, { recursive: true });
+  fs.mkdirSync(hqRoot, { recursive: true });
+  return { home, hqRoot };
+}
+
+afterEach(() => {
+  while (temps.length > 0) {
+    const d = temps.pop();
+    if (d) fs.rmSync(d, { recursive: true, force: true });
+  }
+});
+
+describe("hq db C1 harness (offline)", () => {
+  it("path resolution for two company slugs under documented root", () => {
+    const { home } = fixture();
+    const a = resolveLocalDbPath("indigo", { home });
+    const b = resolveLocalDbPath("acme", { home });
+    expect(a).toContain(path.join(".hq", "db", "indigo", "vault.db"));
+    expect(b).toContain(path.join(".hq", "db", "acme", "vault.db"));
+    expect(a).not.toBe(b);
+  });
+
+  it("status auto-creates WAL SQLite and reopen is stable", () => {
+    const { home } = fixture();
+    const first = ensureAndStatusLocalDb("fixture", { home });
+    expect(first.healthy).toBe(true);
+    expect(first.journalMode?.toLowerCase()).toBe("wal");
+    expect(fs.existsSync(first.path)).toBe(true);
+
+    const size1 = fs.statSync(first.path).size;
+    const second = ensureAndStatusLocalDb("fixture", { home });
+    expect(second.healthy).toBe(true);
+    expect(fs.statSync(second.path).size).toBeGreaterThanOrEqual(size1);
+  });
+
+  it("sql select after migrate smoke table", () => {
+    const { home, hqRoot } = fixture();
+    const migDir = path.join(hqRoot, "companies", "fixture", "db", "migrations");
+    fs.mkdirSync(migDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(migDir, "001_smoke.sql"),
+      "CREATE TABLE smoke (id INTEGER PRIMARY KEY, v TEXT);\nINSERT INTO smoke (v) VALUES ('ok');\n",
+      "utf8",
+    );
+
+    const mig = migrateLocalDb({ company: "fixture", home, hqRoot });
+    expect(mig.applied).toContain("001_smoke.sql");
+
+    const rows = runLocalSql({
+      company: "fixture",
+      home,
+      sql: "SELECT v FROM smoke",
+    });
+    expect(rows.rows[0]).toMatchObject({ v: "ok" });
+
+    const again = migrateLocalDb({ company: "fixture", home, hqRoot });
+    expect(again.applied).toEqual([]);
+    expect(again.skipped.length).toBeGreaterThan(0);
+  });
+});