@indigoai-us/hq-cli 5.77.13 → 5.78.0

package/src/commands/artifact-verify.test.ts

@@ -1,177 +0,0 @@
-/**
- * Marketplace artifact verification (US-021, INSTALL side) tests.
- *
- * Proves the install-time guarantee: the bytes we install are EXACTLY the bytes
- * a moderator approved. Covers the two E2E behaviors required by the story:
- *   - an approved artifact whose S3 object is mutated → hash mismatch → REFUSE.
- *   - signature verification against the platform Ed25519 PUBLIC key.
- *
- * SHARED CONTRACT mirror — we reproduce the publish-side signing here with an
- * ephemeral in-test keypair (no key material in the repo) to prove both sides
- * agree byte-for-byte.
- */
-
-import { describe, it, expect } from 'vitest';
-import {
-  generateKeyPairSync,
-  createHash,
-  sign as cryptoSign,
-} from 'node:crypto';
-import {
-  verifyArtifact,
-  computeArtifactHash,
-  ArtifactVerificationError,
-  ARTIFACT_HASH_ALG,
-} from './pack-install.js';
-
-// Ephemeral platform keypair (regenerated each run — never committed).
-const { publicKey, privateKey } = generateKeyPairSync('ed25519');
-const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
-
-/** Reproduce the hq-pro publish-side: sha256 hex hash + Ed25519 over the hash. */
-function publishSide(bytes: Buffer): { contentHash: string; signature: string } {
-  const contentHash = createHash('sha256').update(bytes).digest('hex');
-  const signature = cryptoSign(
-    null,
-    Buffer.from(contentHash, 'utf-8'),
-    privateKey,
-  ).toString('base64');
-  return { contentHash, signature };
-}
-
-const APPROVED_BYTES = Buffer.from('the-approved-pack.tar.gz-bytes');
-
-describe('computeArtifactHash', () => {
-  it('matches a lowercase-hex sha256 (shared contract with publish)', () => {
-    const expected = createHash('sha256').update(APPROVED_BYTES).digest('hex');
-    expect(computeArtifactHash(APPROVED_BYTES)).toBe(expected);
-    expect(ARTIFACT_HASH_ALG).toBe('sha256');
-  });
-});
-
-describe('verifyArtifact — integrity (hash)', () => {
-  it('passes when the downloaded bytes match the pinned hash + valid signature', () => {
-    const { contentHash, signature } = publishSide(APPROVED_BYTES);
-    expect(() =>
-      verifyArtifact({
-        tarballBytes: APPROVED_BYTES,
-        expectedHash: contentHash,
-        signature,
-        publicKey: publicKeyPem,
-        requireSignature: true,
-      }),
-    ).not.toThrow();
-  });
-
-  it('E2E: a MUTATED S3 object → hash mismatch → REFUSES', () => {
-    // Publish/approval pinned the hash of APPROVED_BYTES…
-    const { contentHash, signature } = publishSide(APPROVED_BYTES);
-    // …but the bytes we actually downloaded were swapped by an attacker.
-    const mutatedBytes = Buffer.from('EVIL-swapped-pack.tar.gz-bytes');
-
-    expect(() =>
-      verifyArtifact({
-        tarballBytes: mutatedBytes,
-        expectedHash: contentHash,
-        signature,
-        publicKey: publicKeyPem,
-      }),
-    ).toThrow(ArtifactVerificationError);
-
-    try {
-      verifyArtifact({
-        tarballBytes: mutatedBytes,
-        expectedHash: contentHash,
-      });
-    } catch (e) {
-      expect((e as Error).message).toMatch(/hash mismatch/i);
-    }
-  });
-
-  it('refuses when the listing provides no valid hash', () => {
-    expect(() =>
-      verifyArtifact({ tarballBytes: APPROVED_BYTES, expectedHash: '' }),
-    ).toThrow(/valid sha256 content hash/i);
-    expect(() =>
-      verifyArtifact({ tarballBytes: APPROVED_BYTES, expectedHash: 'not-a-hash' }),
-    ).toThrow(ArtifactVerificationError);
-  });
-});
-
-describe('verifyArtifact — authenticity (signature)', () => {
-  it('refuses a hash-valid artifact whose signature was forged by a different key', () => {
-    const { contentHash } = publishSide(APPROVED_BYTES);
-    // Attacker signs the (correct) hash with their OWN key.
-    const { privateKey: evilKey } = generateKeyPairSync('ed25519');
-    const forged = cryptoSign(
-      null,
-      Buffer.from(contentHash, 'utf-8'),
-      evilKey,
-    ).toString('base64');
-
-    expect(() =>
-      verifyArtifact({
-        tarballBytes: APPROVED_BYTES,
-        expectedHash: contentHash,
-        signature: forged,
-        publicKey: publicKeyPem, // platform key — won't validate the forgery
-      }),
-    ).toThrow(/signature is invalid/i);
-  });
-
-  it('refuses on a corrupt/garbage signature', () => {
-    const { contentHash } = publishSide(APPROVED_BYTES);
-    expect(() =>
-      verifyArtifact({
-        tarballBytes: APPROVED_BYTES,
-        expectedHash: contentHash,
-        signature: 'not-base64-or-a-real-sig!!!',
-        publicKey: publicKeyPem,
-      }),
-    ).toThrow(ArtifactVerificationError);
-  });
-
-  it('refuses on an invalid public key', () => {
-    const { contentHash, signature } = publishSide(APPROVED_BYTES);
-    expect(() =>
-      verifyArtifact({
-        tarballBytes: APPROVED_BYTES,
-        expectedHash: contentHash,
-        signature,
-        publicKey: 'not a real pem',
-      }),
-    ).toThrow(/public key/i);
-  });
-});
-
-describe('verifyArtifact — deferred-key window', () => {
-  it('hash-verifies but skips signature when none provided (requireSignature=false)', () => {
-    const { contentHash } = publishSide(APPROVED_BYTES);
-    expect(() =>
-      verifyArtifact({ tarballBytes: APPROVED_BYTES, expectedHash: contentHash }),
-    ).not.toThrow();
-  });
-
-  it('refuses an unsigned artifact when requireSignature=true', () => {
-    const { contentHash } = publishSide(APPROVED_BYTES);
-    expect(() =>
-      verifyArtifact({
-        tarballBytes: APPROVED_BYTES,
-        expectedHash: contentHash,
-        requireSignature: true,
-      }),
-    ).toThrow(/unsigned/i);
-  });
-
-  it('refuses when a signature is present but no public key is available (requireSignature=true)', () => {
-    const { contentHash, signature } = publishSide(APPROVED_BYTES);
-    expect(() =>
-      verifyArtifact({
-        tarballBytes: APPROVED_BYTES,
-        expectedHash: contentHash,
-        signature,
-        requireSignature: true,
-      }),
-    ).toThrow(/public key/i);
-  });
-});

package/src/commands/auth.test.ts

@@ -1,82 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { Command } from "commander";
-
-const mocks = vi.hoisted(() => ({
-  browserLogin: vi.fn(),
-  isExpiring: vi.fn(),
-  isMachineIdentity: vi.fn(),
-  loadCachedTokens: vi.fn(),
-  loadMachineCreds: vi.fn(),
-  CognitoAuthError: class TestCognitoAuthError extends Error {},
-}));
-
-vi.mock("@indigoai-us/hq-cloud", () => ({
-  browserLogin: mocks.browserLogin,
-  clearCachedTokens: vi.fn(),
-  isExpiring: mocks.isExpiring,
-  isMachineIdentity: mocks.isMachineIdentity,
-  loadCachedTokens: mocks.loadCachedTokens,
-  loadMachineCreds: mocks.loadMachineCreds,
-  CognitoAuthError: mocks.CognitoAuthError,
-}));
-
-vi.mock("../utils/cognito-session.js", () => ({
-  DEFAULT_COGNITO: {
-    region: "us-east-1",
-    userPoolDomain: "vault-indigo-hq-prod",
-    clientId: "client-123",
-    port: 8765,
-    identityProvider: "Google",
-  },
-  refreshCachedSession: vi.fn(),
-}));
-
-import { registerAuthCommands } from "./auth.js";
-
-class ProcessExitError extends Error {
-  constructor(readonly code: number) {
-    super(`process.exit(${code})`);
-  }
-}
-
-describe("hq auth login", () => {
-  it("REGRESSION: explains how to recover when the callback port is held by another login", async () => {
-    mocks.isMachineIdentity.mockReturnValue(false);
-    mocks.loadCachedTokens.mockReturnValue(undefined);
-    mocks.browserLogin.mockRejectedValue(
-      Object.assign(new Error("listen EADDRINUSE: address already in use 127.0.0.1:8765"), {
-        code: "EADDRINUSE",
-      }),
-    );
-
-    const errors: string[] = [];
-    const errorSpy = vi
-      .spyOn(console, "error")
-      .mockImplementation((...args: unknown[]) => errors.push(args.map(String).join(" ")));
-    const exitSpy = vi
-      .spyOn(process, "exit")
-      .mockImplementation(((code?: number) => {
-        throw new ProcessExitError(code ?? 0);
-      }) as never);
-    const program = new Command();
-    program.exitOverride();
-    registerAuthCommands(program);
-
-    try {
-      await expect(program.parseAsync(["auth", "login"], { from: "user" })).rejects.toMatchObject({
-        code: 1,
-      });
-    } finally {
-      errorSpy.mockRestore();
-      exitSpy.mockRestore();
-    }
-
-    const output = errors.join("\n");
-    expect(output).toContain("Login failed: Browser-login callback port is already in use.");
-    expect(output).not.toContain("EADDRINUSE");
-    expect(output).toContain("callback port (127.0.0.1:8765) is already in use");
-    expect(output).toContain("Another `hq auth login` may still be waiting");
-    expect(output).toContain("stop its terminal/process, then retry");
-    expect(output).not.toContain("sign up at");
-  });
-});

package/src/commands/auth.ts

@@ -1,213 +0,0 @@
-/**
- * `hq auth` — Cognito identity management for HQ.
- *
- * Subcommands:
- *   hq auth login     — open the Cognito Hosted UI in the browser and cache tokens
- *   hq auth logout    — clear the cached HQ session
- *   hq auth refresh   — ensure a valid cached Cognito session (non-interactive)
- *   hq auth status    — show whether a valid session is cached + expiry
- *
- * Sign-up is owned by the onboarding web app at
- * https://onboarding.indigo-hq.com. `hq auth login` signs an existing account
- * into this machine by writing ~/.hq/cognito-tokens.json; once cached, the
- * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
- * by the deploy + sync skills.
- */
-
-import { Command } from "commander";
-import chalk from "chalk";
-import {
-  browserLogin,
-  clearCachedTokens,
-  loadCachedTokens,
-  isExpiring,
-  isMachineIdentity,
-  loadMachineCreds,
-  CognitoAuthError,
-} from "@indigoai-us/hq-cloud";
-import {
-  DEFAULT_COGNITO,
-  refreshCachedSession,
-} from "../utils/cognito-session.js";
-import { cognitoConfigForLoginProvider } from "../utils/login-provider.js";
-
-/**
- * Decode the (unverified) ID token payload for display purposes only.
- * The token was just returned by Cognito's token endpoint, so its contents
- * are trusted enough to print — we never use these claims for authorization.
- */
-function peekIdToken(
-  idToken: string,
-): { email?: string; sub?: string; entityType?: string; entityUid?: string } {
-  try {
-    const payload = idToken.split(".")[1];
-    if (!payload) return {};
-    const pad =
-      payload.length % 4 === 0 ? "" : "=".repeat(4 - (payload.length % 4));
-    const normalized =
-      payload.replace(/-/g, "+").replace(/_/g, "/") + pad;
-    const decoded = JSON.parse(
-      Buffer.from(normalized, "base64").toString("utf-8"),
-    );
-    return {
-      email: decoded.email,
-      sub: decoded.sub,
-      entityType: decoded["custom:entityType"],
-      entityUid: decoded["custom:entityUid"],
-    };
-  } catch {
-    return {};
-  }
-}
-
-/** Display label for the local machine identity (company agents). */
-function machineIdentityLabel(): string {
-  const creds = loadMachineCreds();
-  return creds ? `machine identity ${creds.username}` : "machine identity";
-}
-
-function isCallbackPortCollision(error: unknown): boolean {
-  if (!error || typeof error !== "object") return false;
-  const { code, message } = error as NodeJS.ErrnoException;
-  return code === "EADDRINUSE" || message?.includes("EADDRINUSE") === true;
-}
-
-function callbackPortCollisionGuidance(port: number): string {
-  return (
-    `  The browser-login callback port (127.0.0.1:${port}) is already in use. ` +
-    "Another `hq auth login` may still be waiting for browser sign-in. Finish that login, " +
-    "or stop its terminal/process, then retry."
-  );
-}
-
-export function registerAuthCommands(program: Command): void {
-  const authCmd = program
-    .command("auth")
-    .description("Manage the local HQ Cognito session");
-
-  authCmd
-    .command("login")
-    .description(
-      "Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally",
-    )
-    .option(
-      "--provider <provider>",
-      "OAuth provider to use: google, microsoft, or picker",
-    )
-    .action(async (options: { provider?: string }) => {
-      if (isMachineIdentity()) {
-        console.log(
-          chalk.green(
-            `Running as ${machineIdentityLabel()} — sessions mint automatically; no browser login needed.`,
-          ),
-        );
-        return;
-      }
-      const existing = loadCachedTokens();
-      if (existing && !isExpiring(existing, 120)) {
-        const who = peekIdToken(existing.idToken).email ?? "cached session";
-        console.log(
-          chalk.green(`Already signed in (${who}). Run \`hq auth logout\` to switch accounts.`),
-        );
-        return;
-      }
-      try {
-        const tokens = await browserLogin(cognitoConfigForLoginProvider(options.provider));
-        const who = peekIdToken(tokens.idToken).email ?? "HQ";
-        console.log(chalk.green(`Signed in as ${who}`));
-        console.log(
-          chalk.dim(`  Token cached at ~/.hq/cognito-tokens.json (expires ${tokens.expiresAt})`),
-        );
-      } catch (err) {
-        const callbackPortCollision = isCallbackPortCollision(err);
-        const msg =
-          callbackPortCollision
-            ? "Browser-login callback port is already in use."
-            : err instanceof CognitoAuthError
-              ? err.message
-              : err instanceof Error
-                ? err.message
-                : String(err);
-        console.error(chalk.red(`Login failed: ${msg}`));
-        if (callbackPortCollision) {
-          console.error(
-            chalk.dim(callbackPortCollisionGuidance(DEFAULT_COGNITO.port ?? 8765)),
-          );
-        } else {
-          console.error(
-            chalk.dim(
-              "  If you do not have an account, sign up at https://onboarding.indigo-hq.com",
-            ),
-          );
-        }
-        process.exit(1);
-      }
-    });
-
-  authCmd
-    .command("logout")
-    .description("Clear the cached HQ Cognito session")
-    .action(() => {
-      const existing = loadCachedTokens();
-      if (!existing) {
-        console.log(chalk.yellow("No cached HQ session"));
-        return;
-      }
-      clearCachedTokens();
-      console.log(chalk.green("Signed out — removed ~/.hq/cognito-tokens.json"));
-    });
-
-  authCmd
-    .command("refresh")
-    .description(
-      "Ensure a valid cached Cognito session (refresh only if expiring; no-op if already valid)",
-    )
-    .action(async () => {
-      const result = await refreshCachedSession();
-      if (result.refreshed) {
-        console.log(chalk.green("HQ session ensured"));
-        return;
-      }
-      console.error(
-        chalk.yellow(`No valid session: ${result.reason ?? "unknown"}`),
-      );
-      process.exit(1);
-    });
-
-  authCmd
-    .command("status")
-    .description("Show whether a valid HQ session is cached")
-    .action(() => {
-      const machine = isMachineIdentity();
-      const cached = loadCachedTokens();
-      if (!cached) {
-        if (machine) {
-          // No cached session yet, but machine creds mint one on demand —
-          // report ready, not signed-out.
-          console.log(
-            chalk.green(
-              `${machineIdentityLabel()} — no cached session yet (mints automatically on first use)`,
-            ),
-          );
-          return;
-        }
-        console.log(chalk.yellow("No cached HQ session — run `hq auth login`"));
-        process.exit(1);
-      }
-      const claims = peekIdToken(cached.idToken);
-      const who = machine
-        ? `${machineIdentityLabel()}${claims.entityUid ? ` (${claims.entityUid})` : ""}`
-        : claims.email;
-      const expiring = isExpiring(cached);
-      const label = who ? `${who} — ` : "";
-      console.log(
-        expiring
-          ? chalk.yellow(
-              `${label}HQ session cached but expiring (expiresAt=${cached.expiresAt})`,
-            )
-          : chalk.green(
-              `${label}HQ session valid (expiresAt=${cached.expiresAt})`,
-            ),
-      );
-    });
-}

package/src/commands/billing.test.ts

@@ -1,158 +0,0 @@
-/**
- * Unit tests for `hq billing` (billing.ts).
- *
- * Mirrors company.test.ts: mock ensureCognitoToken + getCompanyUid, spy on
- * global fetch, drive through a Commander program, assert the request shape and
- * rendered output.
- */
-
-import { Command } from "commander";
-import {
-  afterEach,
-  beforeEach,
-  describe,
-  expect,
-  it,
-  vi,
-  type MockInstance,
-} from "vitest";
-
-vi.mock("../utils/cognito-session.js", async (importOriginal) => {
-  const original =
-    await importOriginal<typeof import("../utils/cognito-session.js")>();
-  return {
-    ...original,
-    ensureCognitoToken: vi.fn(async () => "test-token"),
-  };
-});
-
-vi.mock("../utils/vault-api.js", async (importOriginal) => {
-  const original = await importOriginal<typeof import("../utils/vault-api.js")>();
-  return {
-    ...original,
-    getCompanyUid: vi.fn(async () => "cmp_acme"),
-  };
-});
-
-import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { getCompanyUid } from "../utils/vault-api.js";
-import { registerBillingCommand } from "./billing.js";
-
-function jsonResponse(status: number, body: unknown): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-let fetchSpy: MockInstance<typeof fetch>;
-let logSpy: MockInstance<typeof console.log>;
-let stdoutSpy: MockInstance<typeof process.stdout.write>;
-const mockEnsureCognitoToken = vi.mocked(ensureCognitoToken);
-const mockGetCompanyUid = vi.mocked(getCompanyUid);
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  fetchSpy = vi.spyOn(globalThis, "fetch");
-  mockEnsureCognitoToken.mockResolvedValue("test-token");
-  mockGetCompanyUid.mockResolvedValue("cmp_acme");
-  vi.spyOn(process, "exit").mockImplementation((code?: number) => {
-    throw new Error(`process.exit(${code})`);
-  });
-  logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
-  stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
-  vi.spyOn(console, "error").mockImplementation(() => {});
-});
-
-afterEach(() => {
-  vi.restoreAllMocks();
-});
-
-function buildProgram(): Command {
-  const program = new Command();
-  program.name("hq").exitOverride();
-  registerBillingCommand(program);
-  return program;
-}
-
-async function run(args: string[]): Promise<void> {
-  await buildProgram().parseAsync(["node", "hq", ...args]);
-}
-
-describe("hq billing status", () => {
-  it("GETs /v1/billing/summary and renders card-on-file", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        subscriptionStatus: "active",
-        defaultPaymentMethod: { present: true, brand: "visa", last4: "4242" },
-      }),
-    );
-
-    await run(["billing", "--company", "acme", "status"]);
-
-    const url = String(fetchSpy.mock.calls[0][0]);
-    expect(url).toContain("/v1/billing/summary");
-    expect(url).toContain("companyUid=cmp_acme");
-    const printed = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
-    expect(printed).toMatch(/active/);
-    expect(printed).toMatch(/visa/);
-    expect(printed).toMatch(/4242/);
-  });
-
-  it("flags no card on file", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        subscriptionStatus: null,
-        defaultPaymentMethod: { present: false, brand: null, last4: null },
-      }),
-    );
-    await run(["billing", "--company", "acme", "status"]);
-    const printed = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
-    expect(printed).toMatch(/no card on file/i);
-  });
-});
-
-describe("hq billing checkout", () => {
-  it("POSTs /v1/billing/checkout/org with companyUid and prints the url", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, { url: "https://checkout.stripe.com/abc" }),
-    );
-
-    await run(["billing", "--company", "acme", "checkout"]);
-
-    const [url, init] = fetchSpy.mock.calls[0];
-    expect(String(url)).toContain("/v1/billing/checkout/org");
-    expect(init?.method).toBe("POST");
-    expect(JSON.parse(init?.body as string)).toEqual({ companyUid: "cmp_acme" });
-    const printed = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
-    expect(printed).toContain("https://checkout.stripe.com/abc");
-  });
-
-  it("POSTs /v1/billing/checkout/person with --personal", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, { url: "https://checkout.stripe.com/xyz" }),
-    );
-    await run(["billing", "checkout", "--personal"]);
-    const [url, init] = fetchSpy.mock.calls[0];
-    expect(String(url)).toContain("/v1/billing/checkout/person");
-    expect(init?.method).toBe("POST");
-    // Person checkout resolves the payer from the JWT — no companyUid resolution.
-    expect(mockGetCompanyUid).not.toHaveBeenCalled();
-  });
-
-  it("emits raw JSON with --json", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, { url: "https://checkout.stripe.com/j" }),
-    );
-    await run(["billing", "--company", "acme", "checkout", "--json"]);
-    const printed = stdoutSpy.mock.calls.map((c) => String(c[0])).join("\n");
-    expect(printed).toContain("https://checkout.stripe.com/j");
-  });
-
-  it("exits 1 when the checkout response has no url", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    await expect(
-      run(["billing", "--company", "acme", "checkout"]),
-    ).rejects.toThrow("process.exit(1)");
-  });
-});