@indigoai-us/hq-cli 5.77.13 → 5.78.0

package/src/utils/sandbox-runner-client.ts

@@ -1,260 +0,0 @@
-export type SandboxRunnerState = "queued" | "running" | "succeeded" | "failed";
-
-export interface SandboxRunnerStartRequest {
-  companyUid: string;
-  secretNames: string[];
-  command: string;
-}
-
-export interface SandboxRunnerStartResponse {
-  jobId: string;
-  status: SandboxRunnerState;
-}
-
-export interface SandboxRunnerJob {
-  jobId: string;
-  status: SandboxRunnerState;
-  output?: string;
-  error?: string;
-  exitCode?: number;
-  success?: boolean;
-}
-
-export interface SandboxRunnerClientOptions {
-  baseUrl?: string;
-  fetchImpl?: typeof fetch;
-  retry?: SandboxRunnerRetryOptions;
-  sleep?: (ms: number) => Promise<void>;
-}
-
-export interface SandboxRunnerPollOptions {
-  intervalMs?: number;
-  maxPolls?: number;
-}
-
-export interface SandboxRunnerRetryOptions {
-  maxAttempts?: number;
-  maxElapsedMs?: number;
-  baseDelayMs?: number;
-  maxDelayMs?: number;
-}
-
-const DEFAULT_SANDBOX_RUNNER_URL = "https://hqapi.hq.computer/sandbox";
-const RETRYABLE_STATUS_CODES = new Set([408, 425, 429, 500, 502, 503, 504]);
-const DEFAULT_RETRY_OPTIONS: Required<SandboxRunnerRetryOptions> = {
-  maxAttempts: 8,
-  maxElapsedMs: 90_000,
-  baseDelayMs: 500,
-  maxDelayMs: 5_000,
-};
-
-function normalizeBaseUrl(baseUrl: string): string {
-  return baseUrl.replace(/\/+$/, "");
-}
-
-function getSandboxRunnerBaseUrl(): string {
-  return normalizeBaseUrl(
-    process.env.HQ_SANDBOX_RUNNER_URL ?? DEFAULT_SANDBOX_RUNNER_URL,
-  );
-}
-
-function isSandboxRunnerState(value: unknown): value is SandboxRunnerState {
-  return value === "queued" || value === "running" || value === "succeeded" || value === "failed";
-}
-
-async function parseJsonResponse(res: Response): Promise<Record<string, unknown>> {
-  return (await res.json().catch(() => ({}))) as Record<string, unknown>;
-}
-
-function requireString(body: Record<string, unknown>, key: string): string {
-  const value = body[key];
-  if (typeof value !== "string" || value.length === 0) {
-    throw new Error(`Sandbox Runner returned an invalid '${key}'.`);
-  }
-  return value;
-}
-
-function normalizeJob(
-  body: Record<string, unknown>,
-  jobIdFallback?: string,
-): SandboxRunnerJob {
-  const status = body.status;
-  if (!isSandboxRunnerState(status)) {
-    throw new Error("Sandbox Runner returned an invalid job status.");
-  }
-  return {
-    jobId:
-      typeof body.jobId === "string" && body.jobId.length > 0
-        ? body.jobId
-        : jobIdFallback ?? requireString(body, "jobId"),
-    status,
-    output: typeof body.output === "string" ? body.output : undefined,
-    error: typeof body.error === "string" ? body.error : undefined,
-    exitCode: typeof body.exitCode === "number" ? body.exitCode : undefined,
-    success: typeof body.success === "boolean" ? body.success : undefined,
-  };
-}
-
-function delay(ms: number): Promise<void> {
-  if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-function getErrorMessage(error: unknown): string {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  if (typeof error === "string") {
-    return error;
-  }
-  return String(error);
-}
-
-function parseRetryAfterMs(value: string | null): number | undefined {
-  if (!value) return undefined;
-  const seconds = Number(value);
-  if (Number.isFinite(seconds) && seconds >= 0) {
-    return seconds * 1000;
-  }
-  const dateMs = Date.parse(value);
-  if (!Number.isNaN(dateMs)) {
-    return Math.max(0, dateMs - Date.now());
-  }
-  return undefined;
-}
-
-export class SandboxRunnerClient {
-  private readonly baseUrl: string;
-  private readonly fetchImpl: typeof fetch;
-  private readonly retry: Required<SandboxRunnerRetryOptions>;
-  private readonly sleep: (ms: number) => Promise<void>;
-
-  constructor(options: SandboxRunnerClientOptions = {}) {
-    this.baseUrl = normalizeBaseUrl(options.baseUrl ?? getSandboxRunnerBaseUrl());
-    this.fetchImpl = options.fetchImpl ?? fetch;
-    this.retry = { ...DEFAULT_RETRY_OPTIONS, ...options.retry };
-    this.sleep = options.sleep ?? delay;
-  }
-
-  private async fetchWithRetry(
-    url: string,
-    init: RequestInit,
-  ): Promise<Response> {
-    const startedAt = Date.now();
-    let lastError = "unknown error";
-    let attempts = 0;
-
-    for (let attempt = 1; attempt <= this.retry.maxAttempts; attempt += 1) {
-      attempts = attempt;
-      try {
-        const res = await this.fetchImpl(url, init);
-        if (!RETRYABLE_STATUS_CODES.has(res.status)) {
-          return res;
-        }
-        lastError = `HTTP ${res.status} ${res.statusText}`.trim();
-        if (!this.shouldRetry(attempt, startedAt)) {
-          break;
-        }
-        await this.sleep(this.nextDelayMs(attempt, res));
-      } catch (error) {
-        lastError = getErrorMessage(error);
-        if (!this.shouldRetry(attempt, startedAt)) {
-          break;
-        }
-        await this.sleep(this.nextDelayMs(attempt));
-      }
-    }
-
-    throw new Error(
-      `Sandbox Runner did not respond after ${attempts} attempts ` +
-        `(cold start or transient network); last error: ${lastError}`,
-    );
-  }
-
-  private shouldRetry(attempt: number, startedAt: number): boolean {
-    if (attempt >= this.retry.maxAttempts) {
-      return false;
-    }
-    return Date.now() - startedAt < this.retry.maxElapsedMs;
-  }
-
-  private nextDelayMs(attempt: number, res?: Response): number {
-    const retryAfterMs = parseRetryAfterMs(res?.headers.get("Retry-After") ?? null);
-    if (retryAfterMs !== undefined) {
-      return Math.min(retryAfterMs, this.retry.maxDelayMs);
-    }
-    const exponential = this.retry.baseDelayMs * 2 ** (attempt - 1);
-    const capped = Math.min(exponential, this.retry.maxDelayMs);
-    const jitter = Math.floor(Math.random() * Math.max(1, capped * 0.25));
-    return Math.min(capped + jitter, this.retry.maxDelayMs);
-  }
-
-  async startJob(
-    token: string,
-    request: SandboxRunnerStartRequest,
-  ): Promise<SandboxRunnerStartResponse> {
-    const res = await this.fetchWithRetry(`${this.baseUrl}/jobs`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify(request),
-    });
-    const body = await parseJsonResponse(res);
-    if (!res.ok) {
-      const message =
-        typeof body.message === "string"
-          ? body.message
-          : typeof body.error === "string"
-            ? body.error
-            : res.statusText;
-      throw new Error(`Sandbox Runner rejected job: ${message}`);
-    }
-    const status = body.status;
-    if (!isSandboxRunnerState(status)) {
-      throw new Error("Sandbox Runner returned an invalid start status.");
-    }
-    return {
-      jobId: requireString(body, "jobId"),
-      status,
-    };
-  }
-
-  async getJob(token: string, jobId: string): Promise<SandboxRunnerJob> {
-    const res = await this.fetchWithRetry(
-      `${this.baseUrl}/jobs/${encodeURIComponent(jobId)}`,
-      {
-        headers: { Authorization: `Bearer ${token}` },
-      },
-    );
-    const body = await parseJsonResponse(res);
-    if (!res.ok) {
-      const message =
-        typeof body.message === "string"
-          ? body.message
-          : typeof body.error === "string"
-            ? body.error
-            : res.statusText;
-      throw new Error(`Sandbox Runner job lookup failed: ${message}`);
-    }
-    return normalizeJob(body, jobId);
-  }
-
-  async pollJob(
-    token: string,
-    jobId: string,
-    options: SandboxRunnerPollOptions = {},
-  ): Promise<SandboxRunnerJob> {
-    const intervalMs = options.intervalMs ?? 1000;
-    const maxPolls = options.maxPolls ?? 300;
-    for (let attempt = 0; attempt < maxPolls; attempt += 1) {
-      const job = await this.getJob(token, jobId);
-      if (job.status === "succeeded" || job.status === "failed") {
-        return job;
-      }
-      await this.sleep(intervalMs);
-    }
-    throw new Error(`Sandbox Runner job '${jobId}' did not finish before the poll limit.`);
-  }
-}

package/src/utils/secrets-cache.ts

@@ -1,183 +0,0 @@
-import * as crypto from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import * as os from "node:os";
-
-const CACHE_DIR = path.join(os.homedir(), ".hq", "secrets-cache");
-const KEY_PATH = path.join(CACHE_DIR, ".key");
-const CACHE_FORMAT_MAGIC = Buffer.from("HQSC");
-const CACHE_FORMAT_MAGIC_BYTES = CACHE_FORMAT_MAGIC.length;
-const LEGACY_TIMESTAMP_BYTES = 8;
-const TIMESTAMP_BYTES = 8;
-const TTL_BYTES = 8;
-const ALGORITHM = "aes-256-gcm";
-const IV_BYTES = 12;
-const AUTH_TAG_BYTES = 16;
-export const DEFAULT_SECRETS_CACHE_TTL_MS = 5 * 60 * 1000;
-
-function ensureCacheDir(companyUid: string): void {
-  const dir = path.join(CACHE_DIR, companyUid);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-}
-
-function validateInputs(companyUid: string, name: string): boolean {
-  if (!companyUid || companyUid.includes("/") || companyUid.includes("..")) return false;
-  if (!/^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/.test(name)) return false;
-  return true;
-}
-
-function getOrCreateKey(): Buffer {
-  try {
-    const key = fs.readFileSync(KEY_PATH);
-    if (key.length === 32) {
-      const mode = fs.statSync(KEY_PATH).mode & 0o777;
-      if (mode !== 0o600) {
-        process.stderr.write(`Warning: secrets cache key has permissions ${mode.toString(8)}, expected 600\n`);
-      }
-      return key;
-    }
-  } catch {
-    // Key doesn't exist or is unreadable — generate a new one
-  }
-  fs.mkdirSync(CACHE_DIR, { recursive: true, mode: 0o700 });
-  const key = crypto.randomBytes(32);
-  const tmpPath = `${KEY_PATH}.tmp.${process.pid}`;
-  fs.writeFileSync(tmpPath, key, { mode: 0o600 });
-  fs.renameSync(tmpPath, KEY_PATH);
-  return fs.readFileSync(KEY_PATH);
-}
-
-export function readCache(companyUid: string, name: string): string | null {
-  if (!validateInputs(companyUid, name)) return null;
-  const filePath = path.join(CACHE_DIR, companyUid, name);
-  let raw: Buffer;
-  try {
-    raw = fs.readFileSync(filePath);
-  } catch {
-    return null;
-  }
-
-  let timestampMs: number;
-  let ttlMs: number;
-  let ivStart: number;
-  let authTagStart: number;
-  let ciphertextStart: number;
-
-  if (
-    raw.length >=
-      CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES + TTL_BYTES + IV_BYTES + AUTH_TAG_BYTES &&
-    raw.subarray(0, CACHE_FORMAT_MAGIC_BYTES).equals(CACHE_FORMAT_MAGIC)
-  ) {
-    timestampMs = Number(raw.readBigInt64BE(CACHE_FORMAT_MAGIC_BYTES));
-    ttlMs = Number(raw.readBigInt64BE(CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES));
-    ivStart = CACHE_FORMAT_MAGIC_BYTES + TIMESTAMP_BYTES + TTL_BYTES;
-    authTagStart = ivStart + IV_BYTES;
-    ciphertextStart = authTagStart + AUTH_TAG_BYTES;
-  } else {
-    const headerLen = LEGACY_TIMESTAMP_BYTES + IV_BYTES + AUTH_TAG_BYTES;
-    if (raw.length < headerLen) return null;
-    timestampMs = Number(raw.readBigInt64BE(0));
-    ttlMs = DEFAULT_SECRETS_CACHE_TTL_MS;
-    ivStart = LEGACY_TIMESTAMP_BYTES;
-    authTagStart = ivStart + IV_BYTES;
-    ciphertextStart = authTagStart + AUTH_TAG_BYTES;
-  }
-
-  if (ttlMs <= 0 || Date.now() - timestampMs > ttlMs) {
-    try { fs.unlinkSync(filePath); } catch { /* ok */ }
-    return null;
-  }
-
-  const iv = raw.subarray(ivStart, authTagStart);
-  const authTag = raw.subarray(authTagStart, ciphertextStart);
-  const ciphertext = raw.subarray(ciphertextStart);
-
-  let key: Buffer;
-  try {
-    key = getOrCreateKey();
-  } catch {
-    return null;
-  }
-
-  try {
-    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
-    decipher.setAuthTag(authTag);
-    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-    return decrypted.toString("utf8");
-  } catch {
-    try { fs.unlinkSync(filePath); } catch { /* ok */ }
-    return null;
-  }
-}
-
-export function writeCache(
-  companyUid: string,
-  name: string,
-  value: string,
-  ttlMs = DEFAULT_SECRETS_CACHE_TTL_MS,
-): void {
-  try {
-    if (!validateInputs(companyUid, name)) return;
-    if (ttlMs <= 0) return;
-    ensureCacheDir(companyUid);
-    const key = getOrCreateKey();
-    const iv = crypto.randomBytes(IV_BYTES);
-    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-    const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
-    const authTag = cipher.getAuthTag();
-
-    const timestamp = Buffer.alloc(8);
-    timestamp.writeBigInt64BE(BigInt(Date.now()));
-    const ttl = Buffer.alloc(8);
-    ttl.writeBigInt64BE(BigInt(ttlMs));
-
-    const out = Buffer.concat([CACHE_FORMAT_MAGIC, timestamp, ttl, iv, authTag, encrypted]);
-    const filePath = path.join(CACHE_DIR, companyUid, name);
-    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
-    const tmpPath = `${filePath}.tmp.${process.pid}`;
-    fs.writeFileSync(tmpPath, out, { mode: 0o600 });
-    fs.renameSync(tmpPath, filePath);
-  } catch {
-    // Cache write failure is non-fatal
-  }
-}
-
-/**
- * List the scope UIDs (`cmp_*` / `prs_*` subdirectories) that currently have a
- * secrets-cache directory on disk. Install-time MCP registration may use an
- * exactly-one result as a scope hint before reauthorizing every value online; it
- * never reads cached plaintext through this helper. Returns `[]` when the cache
- * root is absent or unreadable.
- */
-export function listSecretCacheScopes(): string[] {
-  try {
-    return fs
-      .readdirSync(CACHE_DIR, { withFileTypes: true })
-      .filter((e) => e.isDirectory())
-      .map((e) => e.name)
-      .filter((name) => /^(?:cmp|prs)_[A-Za-z0-9_-]+$/.test(name));
-  } catch {
-    return [];
-  }
-}
-
-export function removeCacheEntry(companyUid: string, name: string): void {
-  if (!validateInputs(companyUid, name)) return;
-  const filePath = path.join(CACHE_DIR, companyUid, name);
-  try {
-    fs.unlinkSync(filePath);
-  } catch {
-    // Cache entry may not exist
-  }
-}
-
-export function clearAllCache(): { removed: number } {
-  let removed = 0;
-  try {
-    fs.rmSync(CACHE_DIR, { recursive: true, force: true });
-    removed = 1;
-  } catch {
-    // Cache dir may not exist
-  }
-  return { removed };
-}

package/src/utils/sentry-identity.ts

@@ -1,45 +0,0 @@
-import {
-  loadCachedTokens,
-  isMachineIdentity,
-  loadMachineCreds,
-} from "@indigoai-us/hq-cloud";
-
-/** Decode the (untrusted) id-token payload — for attribution/display only. */
-function peekIdToken(idToken: string): { email?: string; sub?: string } {
-  try {
-    const payload = idToken.split(".")[1];
-    if (!payload) return {};
-    const pad =
-      payload.length % 4 === 0 ? "" : "=".repeat(4 - (payload.length % 4));
-    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/") + pad;
-    const decoded = JSON.parse(
-      Buffer.from(normalized, "base64").toString("utf-8"),
-    ) as { email?: string; sub?: string };
-    return { email: decoded.email, sub: decoded.sub };
-  } catch {
-    return {};
-  }
-}
-
-/**
- * Best-effort Sentry user from the cached HQ session, so CLI events are
- * attributed to a user ("users affected" + per-user triage). Returns null when
- * not logged in. A CLI process is single-user, so this is set once at init.
- */
-export function getCachedSentryUser():
-  | { id?: string; email?: string; username?: string }
-  | null {
-  try {
-    if (isMachineIdentity()) {
-      const username = loadMachineCreds()?.username;
-      return username ? { id: username, username } : null;
-    }
-    const cached = loadCachedTokens();
-    if (!cached) return null;
-    const { email, sub } = peekIdToken(cached.idToken);
-    if (!sub && !email) return null;
-    return { id: sub, email };
-  } catch {
-    return null;
-  }
-}

package/src/utils/settle-with-timeout.test.ts

@@ -1,21 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-
-import { settleWithin } from "./settle-with-timeout.js";
-
-describe("settleWithin", () => {
-  it("settles normally when all finalizers finish", async () => {
-    await expect(settleWithin([Promise.resolve(), Promise.reject(new Error("ignored"))], 100))
-      .resolves.toBe("settled");
-  });
-
-  it("settles the caller when a best-effort finalizer never resolves", async () => {
-    vi.useFakeTimers();
-    try {
-      const result = settleWithin([new Promise<void>(() => {})], 1_000);
-      await vi.advanceTimersByTimeAsync(1_000);
-      await expect(result).resolves.toBe("timed_out");
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-});

package/src/utils/settle-with-timeout.ts

@@ -1,22 +0,0 @@
-/**
- * Await finalization work without allowing a best-effort promise to leave a
- * CLI's top-level await pending forever. The timer intentionally stays
- * referenced: Node must remain alive long enough to settle this race.
- */
-export async function settleWithin(
-  promises: readonly Promise<unknown>[],
-  timeoutMs: number,
-): Promise<"settled" | "timed_out"> {
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  const timedOut = new Promise<"timed_out">((resolve) => {
-    timer = setTimeout(() => resolve("timed_out"), timeoutMs);
-  });
-  try {
-    return await Promise.race([
-      Promise.allSettled(promises).then(() => "settled" as const),
-      timedOut,
-    ]);
-  } finally {
-    if (timer !== undefined) clearTimeout(timer);
-  }
-}

package/src/utils/user-yaml-error.test.ts

@@ -1,24 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { isExpectedUserError } from "./expected-cli-error.js";
-import { parseUserYaml } from "./user-yaml-error.js";
-
-describe("parseUserYaml", () => {
-  it("marks malformed user YAML as expected and names its file and location", () => {
-    const filePath = "/tmp/HQ/modules/modules.yaml";
-    const error = (() => {
-      try {
-        parseUserYaml('apiKey: "secret-do-not-echo"\nmodule:\n  name: hq\n bad: indentation\n', filePath);
-      } catch (err) {
-        return err;
-      }
-      throw new Error("expected malformed YAML to throw");
-    })();
-
-    expect(isExpectedUserError(error)).toBe(true);
-    expect((error as Error).message).toContain(
-      `Invalid YAML in ${filePath}:4:2: bad indentation of a mapping entry.`,
-    );
-    expect((error as Error).message).toContain("Fix the indentation or syntax and try again.");
-    expect((error as Error).message).not.toContain("secret-do-not-echo");
-  });
-});

package/src/utils/user-yaml-error.ts

@@ -1,30 +0,0 @@
-import * as yaml from "js-yaml";
-
-/**
- * Parse YAML supplied from an on-disk HQ file.
- *
- * YAML syntax is user-correctable content, not an hq-cli defect. js-yaml's
- * default error includes a source excerpt, which can inadvertently echo
- * secrets, so replace it with a concise, actionable location instead.
- */
-export function parseUserYaml<T>(content: string, filePath: string): T {
-  try {
-    return yaml.load(content, { filename: filePath }) as T;
-  } catch (err) {
-    if (!(err instanceof yaml.YAMLException)) throw err;
-
-    const line = err.mark ? err.mark.line + 1 : undefined;
-    const column = err.mark ? err.mark.column + 1 : undefined;
-    const location = line !== undefined && column !== undefined
-      ? `:${line}:${column}`
-      : "";
-
-    throw Object.assign(
-      new Error(
-        `Invalid YAML in ${filePath}${location}: ${err.reason}. ` +
-          "Fix the indentation or syntax and try again.",
-      ),
-      { expected: true as const },
-    );
-  }
-}