@indigoai-us/hq-cli 5.61.0 → 5.62.1

package/dist/commands/outposts.js

@@ -0,0 +1,255 @@
+/**
+ * `hq outposts` — manage your personal HQ Outposts (EC2 boxes) from the
+ * terminal instead of the web console. Targets the hq-pro `/outpost/*`
+ * control plane on `DEFAULT_VAULT_API_URL` via the shared `vaultApiFetch`
+ * helper — the same routes the console's outpost panel calls.
+ *
+ * Outposts are PERSONAL / caller-scoped: hq-pro keys every `/outpost/*` route
+ * on the caller's Cognito sub, so there is no `--company`. `--id <outpostId>`
+ * selects a specific box (passed as the `outpostId` query param); when omitted
+ * hq-pro targets the caller's primary slot.
+ *
+ * Subcommands:
+ *   hq outposts list                — every Outpost you own (row summaries)
+ *   hq outposts status [--id]       — live detail for one box
+ *   hq outposts codex-enable [--id] — enable / retry Codex on the box
+ *   hq outposts login [--id]        — request a fresh login URL
+ *   hq outposts destroy [--id] --yes — tear the box down (destructive; flag-guarded)
+ *
+ * NOTE: hq-pro exposes no rename or settings-mutation route for Outposts (the
+ * web console can't rename them either), so this CLI wraps only the lifecycle
+ * and status routes that exist. Renaming an Outpost is not a backend capability.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b01c6828-502e-5f7a-b15c-acafef4fa143")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+/** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
+export class OutpostHttpError extends Error {
+    status;
+    step;
+    constructor(status, message, step) {
+        super(message);
+        this.name = "OutpostHttpError";
+        this.status = status;
+        this.step = step;
+    }
+}
+/**
+ * Authenticated JSON round-trip against the outpost control plane. Throws
+ * `OutpostHttpError` on any non-2xx (never swallows — hq-never-swallow-errors),
+ * decoding hq-pro's `{ error | message, step }` envelope for the reason. The
+ * `step` is preserved so callers can recognise the `destroy` route's
+ * `teardown-incomplete` 409 (which means "retry", not "failed").
+ */
+export async function outpostRequest(opts) {
+    const res = await vaultApiFetch(opts);
+    if (!res.ok) {
+        const body = (await res.json().catch(() => ({})));
+        const message = typeof body.message === "string"
+            ? body.message
+            : typeof body.error === "string"
+                ? body.error
+                : res.statusText;
+        throw new OutpostHttpError(res.status, message, body.step);
+    }
+    return (await res.json());
+}
+export async function listOutposts(token) {
+    const data = await outpostRequest({
+        token,
+        path: "/outpost/list",
+    });
+    return data.outposts ?? [];
+}
+export async function getOutpostStatus(token, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/status",
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
+export async function enableCodex(token, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/codex/enable",
+        method: "POST",
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
+export async function regenerateLoginUrl(token, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/regenerate-login-url",
+        method: "POST",
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
+export async function destroyOutpost(token, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/destroy",
+        method: "POST",
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+function fail(err) {
+    if (err instanceof OutpostHttpError) {
+        console.error(chalk.red(err.message));
+    }
+    else {
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+    }
+    process.exit(1);
+}
+/** Print a top-level object as `key: value`, JSON-ifying nested values. */
+function printKeyValues(obj) {
+    for (const [k, v] of Object.entries(obj)) {
+        const rendered = v && typeof v === "object" ? JSON.stringify(v) : String(v);
+        console.log(`${chalk.bold(k)}: ${rendered}`);
+    }
+}
+export function registerOutpostsCommand(program) {
+    const outposts = program
+        .command("outposts")
+        .description("Manage your personal HQ Outposts (EC2 boxes)");
+    outposts
+        .command("list")
+        .description("List every Outpost you own")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const rows = await listOutposts(token);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(rows, null, 2) + "\n");
+                return;
+            }
+            if (rows.length === 0) {
+                console.log(chalk.gray("You don't own any Outposts yet."));
+                return;
+            }
+            const idW = Math.max(2, ...rows.map((r) => (r.outpostId ?? "").length));
+            const stateW = Math.max(5, ...rows.map((r) => (r.state ?? "").length));
+            const nameW = Math.max(4, ...rows.map((r) => (r.instanceName ?? "").length));
+            const regionW = Math.max(6, ...rows.map((r) => (r.region ?? "").length));
+            const rtW = Math.max(7, ...rows.map((r) => (r.agentRuntime ?? "").length));
+            console.log(chalk.bold([
+                "ID".padEnd(idW),
+                "STATE".padEnd(stateW),
+                "INSTANCE".padEnd(nameW),
+                "REGION".padEnd(regionW),
+                "RUNTIME".padEnd(rtW),
+                "PLATFORM",
+            ].join("  ")));
+            for (const r of rows) {
+                console.log([
+                    (r.outpostId ?? "").padEnd(idW),
+                    (r.state ?? "").padEnd(stateW),
+                    (r.instanceName ?? "").padEnd(nameW),
+                    (r.region ?? "").padEnd(regionW),
+                    (r.agentRuntime ?? "").padEnd(rtW),
+                    r.platform ?? "",
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("status")
+        .description("Show live detail for one Outpost")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const status = await getOutpostStatus(token, opts.id);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(status, null, 2) + "\n");
+                return;
+            }
+            printKeyValues(status);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("codex-enable")
+        .description("Enable (or retry) Codex on an Outpost")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const result = await enableCodex(token, opts.id);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log(chalk.green("Codex enablement requested for the Outpost."));
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("login")
+        .description("Request a fresh login URL for an Outpost")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (opts) {
+        try {
+            const token = await ensureCognitoToken();
+            const result = await regenerateLoginUrl(token, opts.id);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log(chalk.green("Login-URL regeneration requested. The box mints a fresh URL shortly — " +
+                "check `hq outposts status` to pick it up."));
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("destroy")
+        .description("Tear down (permanently destroy) an Outpost")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--yes", "Confirm the irreversible teardown (required)")
+        .action(async function (opts) {
+        const target = opts.id ?? "your primary Outpost";
+        if (!opts.yes) {
+            console.error(chalk.yellow(`This will permanently destroy ${target} and delete its cloud resources. ` +
+                `This cannot be undone.\n` +
+                `Re-run with --yes to confirm: hq outposts destroy${opts.id ? ` --id ${opts.id}` : ""} --yes`));
+            process.exit(1);
+        }
+        try {
+            const token = await ensureCognitoToken();
+            await destroyOutpost(token, opts.id);
+            console.log(chalk.green(`Destroyed ${target}.`));
+        }
+        catch (err) {
+            // A 409 teardown-incomplete is not a failure — the gateway's 30s cap
+            // fired while the Lambda keeps working. The row is preserved and the
+            // operation is idempotent, so tell the caller to retry.
+            if (err instanceof OutpostHttpError &&
+                (err.status === 409 || err.step === "teardown-incomplete")) {
+                console.log(chalk.yellow(`Teardown still in progress for ${target} — this is expected for large boxes. ` +
+                    `Re-run the same destroy command to finish (it's idempotent).`));
+                return;
+            }
+            fail(err);
+        }
+    });
+}
+//# sourceMappingURL=outposts.js.map
+//# debugId=b01c6828-502e-5f7a-b15c-acafef4fa143

package/dist/commands/secrets.d.ts

@@ -41,6 +41,14 @@ export interface SecretInjectionRecipe {
     scheme: "raw" | "bearer";
     extraHeaders?: Record<string, string>;
 }
+export declare function parseDestinationUrl(raw: string): {
+    ok: true;
+    url: string;
+    hostname: string;
+} | {
+    ok: false;
+};
+export declare function collectSecretNames(value: string, previous?: string[]): string[];
 export declare function scrubSandboxOutput(text: string, secretNames?: string[]): string;
 export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage): Promise<Map<string, string>>;
 export declare function registerSecretsCommand(program: Command): void;

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ac2acbfe-d6f8-52af-9e1a-38b43474a6d5")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="136bd272-0091-5fce-9a93-a2a375f98b38")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -192,7 +192,7 @@ function parseAuthStyle(authStyle) {
 // (src/vault-service/handlers/secrets.ts) so a malformed URL is caught
 // locally with an actionable message rather than a round trip — the server
 // re-validates and remains authoritative.
-function parseDestinationUrl(raw) {
+export function parseDestinationUrl(raw) {
     let parsed;
     try {
         parsed = new URL(raw);
@@ -209,6 +209,13 @@ function parseDestinationUrl(raw) {
         console.error(chalk.red(`Invalid --destination '${raw}': missing hostname`));
         return { ok: false };
     }
+    // Reject an embedded `user:pass@host` credential segment explicitly rather
+    // than letting `new URL()` silently drop it (mirrors hq-pro's authoritative
+    // `validateDestinations`; the server re-validates and remains authoritative).
+    if (parsed.username !== "" || parsed.password !== "") {
+        console.error(chalk.red(`Invalid --destination '${raw}': must not contain embedded userinfo (user:pass@) credentials`));
+        return { ok: false };
+    }
     if ((parsed.pathname !== "" && parsed.pathname !== "/") ||
         parsed.search !== "" ||
         parsed.hash !== "") {
@@ -252,8 +259,16 @@ async function buildSecretUsage(channel, scriptPath, scriptId, attestationLevel
         },
     };
 }
+// Commander collector for `--only`: accumulates across REPEATED flags instead
+// of the last one silently winning, and each value may still be
+// comma-separated. So `--only A,B`, `--only A --only B`, and
+// `--only A,B --only C` all resolve to the full list.
+export function collectSecretNames(value, previous) {
+    const parsed = value.split(",").map((k) => k.trim()).filter(Boolean);
+    return (previous ?? []).concat(parsed);
+}
 function parseSecretNameList(input) {
-    const keys = input.split(",").map((k) => k.trim()).filter(Boolean);
+    const keys = input ?? [];
     if (keys.length === 0) {
         console.error(chalk.red("Error: --only requires at least one secret name."));
         process.exit(1);
@@ -997,11 +1012,11 @@ export function registerSecretsCommand(program) {
         .description("Run a command in the hosted sandbox with named secrets injected as env vars; open egress, secrets never touch this machine")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--personal", "Operate on the caller's personal vault (no sharing)")
-        .option("--only <keys>", "Comma-separated list of secret names to inject (required)")
+        .option("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
         .allowUnknownOption(true)
         .action(async (opts, cmd) => {
         try {
-            if (!opts.only || opts.only.trim().length === 0) {
+            if (!opts.only || opts.only.length === 0) {
                 console.error(chalk.red("Error: --only is required and must name at least one secret."));
                 process.exit(1);
             }
@@ -1044,7 +1059,7 @@ export function registerSecretsCommand(program) {
     secrets
         .command("exec")
         .description("Run a command with secrets injected as env vars")
-        .requiredOption("--only <keys>", "Comma-separated list of secret names to inject (required)")
+        .requiredOption("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
         .option("--script <path>", "Attach local script identity for script-locked secrets")
         .allowUnknownOption(true)
         .action(async (_opts, cmd) => {
@@ -1100,7 +1115,7 @@ export function registerSecretsCommand(program) {
     secrets
         .command("env")
         .description("Print 'export KEY=VALUE' lines suitable for: source <(hq secrets env --only K1,K2)")
-        .requiredOption("--only <keys>", "Comma-separated list of secret names to print (required)")
+        .requiredOption("--only <keys>", "Secret names to print (comma-separated; may be repeated) (required)", collectSecretNames)
         .option("--script <path>", "Attach local script identity for script-locked secrets")
         .action(async (opts) => {
         try {
@@ -1382,4 +1397,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=ac2acbfe-d6f8-52af-9e1a-38b43474a6d5
+//# debugId=136bd272-0091-5fce-9a93-a2a375f98b38

package/dist/commands/skill.d.ts

@@ -0,0 +1,153 @@
+/**
+ * `hq skill` subcommand group (US-017).
+ *
+ * Terminal / scriptable access to the skill collaboration loop:
+ *
+ *   hq skill suggest <uid|path>   Propose a change to a skill from working edits.
+ *   hq skill list-suggestions     Show the review inbox (suggestions on skills you own).
+ *   hq skill review <sgn_…>       Accept (merge) or decline a pending suggestion.
+ *
+ * This is a THIN front-end over the SAME wired hq-pro routes the MCP surface
+ * (US-007) and the console merge path (US-009) use — there is NO forked
+ * suggestion or merge logic here. The CLI reads the local working SKILL.md,
+ * computes the proposed content (+ its base for a diff), and POSTs to:
+ *
+ *   CREATE  POST /v1/files/skills/company/{slug}/{skillUid}/suggestions
+ *   LIST    POST /v1/files/skills/company/{slug}/suggestions/list
+ *   ACCEPT  POST /v1/files/skills/company/{slug}/{skillUid}/suggestions/{id}/accept
+ *   DECLINE POST /v1/files/skills/company/{slug}/{skillUid}/suggestions/{id}/decline
+ *
+ * The skill routes are keyed on the company SLUG (path param, resolved
+ * server-side via findEntityBySlug) — NOT the companyUid the vault/ACL routes
+ * use — so this module resolves a slug (from `--company` or the active company)
+ * and passes it straight through.
+ *
+ * Lock semantics (AC3): a suggest against a skill the caller cannot WRITE still
+ * SUCCEEDS as a proposal. The CREATE route is MEMBER-gated (never write-gated),
+ * so this command performs NO client-side lock/permission pre-check — it always
+ * posts and renders whatever the server returns. A locked-out member lands a
+ * suggestion, never a hard permission error.
+ *
+ * Attribution (AC4): the invoking identity (from the Cognito JWT) is the server-
+ * derived `authorPersonUid`; the CLI never sends an author. An optional
+ * `--note` rides as `authorNote` (the change's rationale / failure context).
+ */
+import { Command } from "commander";
+/**
+ * A `skl_…` argument to `suggest` is a skill UID (resolve the local file from
+ * it); anything else is a filesystem path. Lenient on the suffix (the strict
+ * `skl_<ulid>` shape is `isSkillUid` on the server) so a hand-typed / fixture
+ * uid still routes to the uid branch.
+ */
+export declare const SKILL_UID_PATTERN: RegExp;
+/** A `sgn_…` suggestion id — the `review` target and the LIST row key. */
+export declare const SUGGESTION_ID_PATTERN: RegExp;
+/**
+ * Read the top-level `skill_uid` from a SKILL.md's YAML frontmatter. Mirrors
+ * hq-pro's `parseSkillFrontmatter` (block extraction → YAML parse → read the
+ * top-level `skill_uid` string). Returns `undefined` when there is no
+ * frontmatter, it fails to parse, or `skill_uid` is absent / not a `skl_…`
+ * string. Never throws.
+ */
+export declare function parseSkillUid(md: string): string | undefined;
+/** sha256 hex of a string — the base-version fingerprint the server records (AC2). */
+export declare function sha256Hex(content: string): string;
+export interface SuggestionCreateBody {
+    proposedContent: string;
+    baseContent?: string;
+    baseContentHash?: string;
+    authorNote?: string;
+}
+/**
+ * Build the CREATE request body from the resolved proposed content and an
+ * optional base. Mirrors the server's two payload shapes:
+ *   - `baseContent` present → the server derives the unified diff + base hash
+ *     (the diff-by-default path). A no-op (base === proposed) is rejected here
+ *     rather than round-tripped to an EmptySuggestion 400.
+ *   - no base → a `full-file` proposal; the server REQUIRES a `baseContentHash`,
+ *     so we fingerprint the proposed content (a "here is my whole file" proposal
+ *     with no base to diff against).
+ * An empty / whitespace-only note is dropped (kept absent, not blank).
+ */
+export declare function buildSuggestionCreateBody(input: {
+    proposedContent: string;
+    baseContent?: string;
+    note?: string;
+}): SuggestionCreateBody;
+/**
+ * Map an hq-pro skill route error to a single user-facing line. Pure so the
+ * status → copy mapping is unit-tested independently of the network. Prefers the
+ * server's own `error` / `message` (they carry the actionable specifics — e.g.
+ * "Skill not found", "You need write access to this skill…").
+ */
+export declare function mapSkillError(status: number, body: Record<string, unknown>): string;
+/** LIST inbox row shape returned by `suggestionToWire` on the server. */
+export interface SuggestionRow {
+    suggestionId: string;
+    skillUid: string;
+    authorPersonUid: string;
+    status: string;
+    baseChanged: boolean;
+    presentation?: string;
+    unifiedDiff?: string;
+    fullContent?: string;
+    baseContentHash?: string;
+    currentContentHash?: string;
+    authorNote?: string;
+    createdAt: string;
+    path: string;
+}
+/**
+ * Render the review inbox as a table (one row per suggestion), optionally
+ * printing each suggestion's unified diff (or full proposed file, when the base
+ * drifted / the proposal is full-file) beneath its row. Pure → snapshot-testable.
+ */
+export declare function formatSuggestionsList(suggestions: SuggestionRow[], opts?: {
+    showDiff?: boolean;
+}): string;
+/** Read `.hq/config.json`'s `activeCompany` (mirrors signals/sources). */
+export declare function readActiveCompanySlug(hqRoot: string): string | undefined;
+/**
+ * The skill routes are keyed on the company SLUG. Precedence: explicit
+ * `--company` → `.hq/config.json` activeCompany. Throws with actionable copy
+ * when neither is available.
+ */
+export declare function resolveCompanySlug(flag: string | undefined, hqRoot?: string): string;
+export interface ResolvedSkillTarget {
+    /** Absolute path to the SKILL.md. */
+    filePath: string;
+    /** The `skl_…` uid read from its frontmatter (or the uid arg). */
+    skillUid: string;
+    /** The working-tree SKILL.md content — the proposed content. */
+    content: string;
+}
+/**
+ * Recursively find a SKILL.md whose frontmatter `skill_uid` equals `uid`,
+ * searching each root breadth-first with a bounded depth (skips VCS / build /
+ * dependency dirs). Returns the first match's absolute path, or null.
+ */
+export declare function findSkillFileByUid(roots: string[], uid: string, maxDepth?: number): string | null;
+/**
+ * Resolve a `suggest` target (a `skl_…` uid OR a filesystem path) to the local
+ * SKILL.md, its uid, and its content. A uid is resolved by scanning the company
+ * skills dir and the cwd; a path is read directly (a directory → its SKILL.md),
+ * with the uid read from the file's frontmatter.
+ */
+export declare function resolveSkillTarget(target: string, deps: {
+    cwd: string;
+    hqRoot: string;
+    companySlug: string;
+}): ResolvedSkillTarget;
+/**
+ * Read the committed (HEAD) version of a file from its git repo — the diff base
+ * for "propose my working changes". Returns null when the file is untracked, not
+ * in a repo, or git is unavailable (the caller then falls back to full-file, or
+ * errors under `--diff`). Never throws.
+ */
+export declare function readGitBase(filePath: string): Promise<string | null>;
+/** Injectable git-base seam so `suggest` is testable without a real repo. */
+export type GitBaseReader = (filePath: string) => Promise<string | null>;
+export declare function registerSkillCommand(program: Command, deps?: {
+    gitBase?: GitBaseReader;
+}): Command;
+//# sourceMappingURL=skill.d.ts.map