@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/utils/cli-telemetry.test.ts

@@ -1,153 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// Each case does vi.resetModules() + a dynamic import() to reset the module-scoped
-// once-per-process memoization; the cold transform/import is slow, so raise the
-// per-test timeout well above the default 5s.
-vi.setConfig({ testTimeout: 30_000 });
-
-const mocks = vi.hoisted(() => ({
-  browserLogin: vi.fn(),
-  isExpiring: vi.fn(),
-  isMachineIdentity: vi.fn(),
-  loadCachedTokens: vi.fn(),
-  refreshTokens: vi.fn(),
-  vaultApiFetch: vi.fn(),
-}));
-
-vi.mock("@indigoai-us/hq-cloud", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@indigoai-us/hq-cloud")>();
-  return { ...actual, ...mocks };
-});
-
-vi.mock("./vault-api.js", () => ({
-  vaultApiFetch: mocks.vaultApiFetch,
-}));
-
-vi.mock("../cli-version.js", () => ({
-  CLI_NAME: "@indigoai-us/hq-cli",
-  CLI_VERSION: "5.68.1",
-}));
-
-const HUMAN_TOKENS = {
-  accessToken: "human-access-token",
-  idToken: "human-id-token",
-  refreshToken: "human-refresh-token",
-  expiresAt: Date.now() + 3_600_000,
-  tokenType: "Bearer" as const,
-};
-
-const MACHINE_TOKENS = {
-  ...HUMAN_TOKENS,
-  accessToken: "machine-access-token",
-  idToken: "machine-id-token",
-};
-
-async function loadEmitter() {
-  vi.resetModules();
-  return import("./cli-telemetry.js");
-}
-
-beforeEach(() => {
-  vi.resetAllMocks();
-  mocks.isMachineIdentity.mockReturnValue(false);
-  mocks.isExpiring.mockReturnValue(false);
-  mocks.vaultApiFetch.mockResolvedValue(new Response(null, { status: 202 }));
-});
-
-afterEach(() => {
-  vi.useRealTimers();
-});
-
-describe("emitCliSessionStarted", () => {
-  it("posts the privacy-safe event with a valid cached human token", async () => {
-    mocks.loadCachedTokens.mockReturnValue(HUMAN_TOKENS);
-    const { emitCliSessionStarted } = await loadEmitter();
-
-    await emitCliSessionStarted();
-
-    expect(mocks.vaultApiFetch).toHaveBeenCalledTimes(1);
-    const request = mocks.vaultApiFetch.mock.calls[0]?.[0];
-    expect(request).toMatchObject({
-      token: HUMAN_TOKENS.accessToken,
-      path: "/v1/telemetry/events",
-      method: "POST",
-      signal: expect.any(AbortSignal),
-    });
-    expect(request.body.events).toHaveLength(1);
-    expect(request.body.events[0]).toEqual({
-      eventName: "cli_session_started",
-      app: "hq-cli",
-      source: "cli",
-      occurredAt: expect.any(String),
-      schemaVersion: 1,
-      properties: { version: "5.68.1" },
-    });
-  });
-
-  it("uses the cached ID token for a machine identity", async () => {
-    mocks.isMachineIdentity.mockReturnValue(true);
-    mocks.loadCachedTokens.mockReturnValue(MACHINE_TOKENS);
-    const { emitCliSessionStarted } = await loadEmitter();
-
-    await emitCliSessionStarted();
-
-    expect(mocks.vaultApiFetch).toHaveBeenCalledWith(
-      expect.objectContaining({ token: MACHINE_TOKENS.idToken }),
-    );
-  });
-
-  it.each([
-    ["is absent", null, false],
-    ["is expiring", HUMAN_TOKENS, true],
-  ])(
-    "does not emit or refresh/login when the cached token %s",
-    async (_description, cachedTokens, expiring) => {
-      mocks.loadCachedTokens.mockReturnValue(cachedTokens);
-      mocks.isExpiring.mockReturnValue(expiring);
-      const { emitCliSessionStarted } = await loadEmitter();
-
-      await emitCliSessionStarted();
-
-      expect(mocks.vaultApiFetch).not.toHaveBeenCalled();
-      expect(mocks.refreshTokens).not.toHaveBeenCalled();
-      expect(mocks.browserLogin).not.toHaveBeenCalled();
-    },
-  );
-
-  it("swallows a non-2xx telemetry response", async () => {
-    mocks.loadCachedTokens.mockReturnValue(HUMAN_TOKENS);
-    mocks.vaultApiFetch.mockResolvedValue(new Response(null, { status: 503 }));
-    const { emitCliSessionStarted } = await loadEmitter();
-
-    await expect(emitCliSessionStarted()).resolves.toBeUndefined();
-  });
-
-  it("aborts a slow telemetry request without failing the command", async () => {
-    vi.useFakeTimers();
-    mocks.loadCachedTokens.mockReturnValue(HUMAN_TOKENS);
-    mocks.vaultApiFetch.mockImplementation(
-      ({ signal }: { signal: AbortSignal }) =>
-        new Promise((_resolve, reject) => {
-          signal.addEventListener("abort", () => reject(new Error("aborted")), {
-            once: true,
-          });
-        }),
-    );
-    const { emitCliSessionStarted } = await loadEmitter();
-
-    const emission = emitCliSessionStarted();
-    await vi.advanceTimersByTimeAsync(1_200);
-
-    await expect(emission).resolves.toBeUndefined();
-    expect(mocks.vaultApiFetch.mock.calls[0]?.[0].signal.aborted).toBe(true);
-  });
-
-  it("posts at most once when the root hook is invoked repeatedly", async () => {
-    mocks.loadCachedTokens.mockReturnValue(HUMAN_TOKENS);
-    const { emitCliSessionStarted } = await loadEmitter();
-
-    await Promise.all([emitCliSessionStarted(), emitCliSessionStarted()]);
-
-    expect(mocks.vaultApiFetch).toHaveBeenCalledTimes(1);
-  });
-});

package/src/utils/cli-telemetry.ts

@@ -1,61 +0,0 @@
-import { CLI_VERSION } from "../cli-version.js";
-import {
-  isExpiring,
-  isMachineIdentity,
-  loadCachedTokens,
-} from "./cognito-session.js";
-import { vaultApiFetch } from "./vault-api.js";
-
-const TELEMETRY_TIMEOUT_MS = 1_200;
-
-let cliSessionStartedPromise: Promise<void> | undefined;
-
-/**
- * Emit the authenticated CLI session signal using an already-cached token.
- * This deliberately never refreshes a session or opens a browser.
- */
-export function emitCliSessionStarted(): Promise<void> {
-  cliSessionStartedPromise ??= emitCachedCliSessionStarted();
-  return cliSessionStartedPromise;
-}
-
-async function emitCachedCliSessionStarted(): Promise<void> {
-  try {
-    const cached = loadCachedTokens();
-    if (!cached || isExpiring(cached, 120)) return;
-
-    const token = isMachineIdentity() ? cached.idToken : cached.accessToken;
-    if (!token) return;
-
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), TELEMETRY_TIMEOUT_MS);
-
-    try {
-      const response = await vaultApiFetch({
-        token,
-        path: "/v1/telemetry/events",
-        method: "POST",
-        body: {
-          events: [
-            {
-              eventName: "cli_session_started",
-              app: "hq-cli",
-              source: "cli",
-              occurredAt: new Date().toISOString(),
-              schemaVersion: 1,
-              properties: { version: CLI_VERSION },
-            },
-          ],
-        },
-        signal: controller.signal,
-      });
-      if (!response.ok) return;
-    } catch {
-      // Telemetry is best effort and must never affect a CLI command.
-    } finally {
-      clearTimeout(timeout);
-    }
-  } catch {
-    // Cached-token reads are also best effort (for example, a malformed cache).
-  }
-}

package/src/utils/cognito-session.machine.test.ts

@@ -1,109 +0,0 @@
-/**
- * Machine-identity behavior of the shared Cognito session helpers.
- *
- * When machine creds are present (company agent boxes), the CLI must:
- *   - return the ID token from ensureCognitoToken() — the vault API's JWT
- *     authorizer accepts ID tokens and the agent claims
- *     (custom:entityType/custom:entityUid) ride the ID token only
- *   - never refresh or open a browser — sessions re-mint on demand
- *   - treat `hq auth refresh` as a non-interactive ensure-valid-session call
- */
-
-import { describe, it, expect, beforeEach, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-  isMachineIdentity: vi.fn(),
-  getValidMachineTokens: vi.fn(),
-  mintMachineTokens: vi.fn(),
-  loadCachedTokens: vi.fn(),
-  refreshTokens: vi.fn(),
-  browserLogin: vi.fn(),
-  isExpiring: vi.fn(),
-}));
-
-vi.mock("@indigoai-us/hq-cloud", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@indigoai-us/hq-cloud")>();
-  return { ...actual, ...mocks };
-});
-
-import {
-  ensureCognitoToken,
-  refreshCachedSession,
-} from "./cognito-session.js";
-
-const MACHINE_TOKENS = {
-  accessToken: "machine-access-token",
-  idToken: "machine-id-token",
-  refreshToken: "",
-  expiresAt: Date.now() + 3600_000,
-  tokenType: "Bearer" as const,
-};
-
-beforeEach(() => {
-  vi.resetAllMocks();
-});
-
-describe("ensureCognitoToken in machine mode", () => {
-  it("returns the ID token (agent claims ride the ID token only)", async () => {
-    mocks.isMachineIdentity.mockReturnValue(true);
-    mocks.getValidMachineTokens.mockResolvedValue(MACHINE_TOKENS);
-
-    const token = await ensureCognitoToken({ interactive: false });
-
-    expect(token).toBe("machine-id-token");
-    expect(mocks.getValidMachineTokens).toHaveBeenCalledTimes(1);
-    expect(mocks.refreshTokens).not.toHaveBeenCalled();
-    expect(mocks.browserLogin).not.toHaveBeenCalled();
-    expect(mocks.loadCachedTokens).not.toHaveBeenCalled();
-  });
-
-  it("falls through to the browser-session path for human identities", async () => {
-    mocks.isMachineIdentity.mockReturnValue(false);
-    mocks.loadCachedTokens.mockReturnValue({
-      ...MACHINE_TOKENS,
-      accessToken: "human-access-token",
-    });
-    mocks.isExpiring.mockReturnValue(false);
-
-    const token = await ensureCognitoToken({ interactive: false });
-
-    expect(token).toBe("human-access-token");
-    expect(mocks.getValidMachineTokens).not.toHaveBeenCalled();
-  });
-
-  it("propagates mint failures instead of opening a browser", async () => {
-    mocks.isMachineIdentity.mockReturnValue(true);
-    mocks.getValidMachineTokens.mockRejectedValue(new Error("mint failed"));
-
-    await expect(ensureCognitoToken()).rejects.toThrow("mint failed");
-    expect(mocks.browserLogin).not.toHaveBeenCalled();
-  });
-});
-
-describe("refreshCachedSession in machine mode", () => {
-  it("ensures a healthy machine session via getValidMachineTokens", async () => {
-    mocks.isMachineIdentity.mockReturnValue(true);
-    mocks.getValidMachineTokens.mockResolvedValue(MACHINE_TOKENS);
-
-    const result = await refreshCachedSession();
-
-    expect(result).toEqual({ refreshed: true });
-    expect(mocks.getValidMachineTokens).toHaveBeenCalledTimes(1);
-    expect(mocks.mintMachineTokens).not.toHaveBeenCalled();
-    expect(mocks.refreshTokens).not.toHaveBeenCalled();
-    expect(mocks.browserLogin).not.toHaveBeenCalled();
-    expect(mocks.loadCachedTokens).not.toHaveBeenCalled();
-  });
-
-  it("surfaces the machine-session error as the reason on failure", async () => {
-    mocks.isMachineIdentity.mockReturnValue(true);
-    mocks.getValidMachineTokens.mockRejectedValue(new Error("NotAuthorized"));
-
-    const result = await refreshCachedSession();
-
-    expect(result.refreshed).toBe(false);
-    expect(result.reason).toContain("NotAuthorized");
-    expect(mocks.refreshTokens).not.toHaveBeenCalled();
-    expect(mocks.browserLogin).not.toHaveBeenCalled();
-  });
-});

package/src/utils/cognito-session.refresh.test.ts

@@ -1,84 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-  isMachineIdentity: vi.fn(),
-  getValidMachineTokens: vi.fn(),
-  mintMachineTokens: vi.fn(),
-  loadCachedTokens: vi.fn(),
-  refreshTokens: vi.fn(),
-  browserLogin: vi.fn(),
-  isExpiring: vi.fn(),
-}));
-
-vi.mock("@indigoai-us/hq-cloud", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@indigoai-us/hq-cloud")>();
-  return { ...actual, ...mocks };
-});
-
-import { refreshCachedSession } from "./cognito-session.js";
-
-const HUMAN_TOKENS = {
-  accessToken: "human-access-token",
-  idToken: "human-id-token",
-  refreshToken: "human-refresh-token",
-  expiresAt: Date.now() + 3600_000,
-  tokenType: "Bearer" as const,
-};
-
-beforeEach(() => {
-  vi.resetAllMocks();
-});
-
-describe("refreshCachedSession in human mode", () => {
-  it("returns no cached session without attempting a refresh", async () => {
-    mocks.isMachineIdentity.mockReturnValue(false);
-    mocks.loadCachedTokens.mockReturnValue(null);
-
-    const result = await refreshCachedSession();
-
-    expect(result).toEqual({ refreshed: false, reason: "no cached session" });
-    expect(mocks.refreshTokens).not.toHaveBeenCalled();
-  });
-
-  it("returns success on a healthy cached session without refreshing", async () => {
-    mocks.isMachineIdentity.mockReturnValue(false);
-    mocks.loadCachedTokens.mockReturnValue(HUMAN_TOKENS);
-    mocks.isExpiring.mockReturnValue(false);
-
-    const result = await refreshCachedSession();
-
-    expect(result).toEqual({ refreshed: true });
-    expect(mocks.isExpiring).toHaveBeenCalledWith(HUMAN_TOKENS, 120);
-    expect(mocks.refreshTokens).not.toHaveBeenCalled();
-  });
-
-  it("refreshes once when the cached session is expiring", async () => {
-    mocks.isMachineIdentity.mockReturnValue(false);
-    mocks.loadCachedTokens.mockReturnValue(HUMAN_TOKENS);
-    mocks.isExpiring.mockReturnValue(true);
-    mocks.refreshTokens.mockResolvedValue({
-      ...HUMAN_TOKENS,
-      accessToken: "refreshed-access-token",
-    });
-
-    const result = await refreshCachedSession();
-
-    expect(result).toEqual({ refreshed: true });
-    expect(mocks.refreshTokens).toHaveBeenCalledTimes(1);
-    expect(mocks.refreshTokens).toHaveBeenCalledWith(
-      expect.any(Object),
-      HUMAN_TOKENS.refreshToken,
-    );
-  });
-
-  it("surfaces refresh failures as a non-throwing result", async () => {
-    mocks.isMachineIdentity.mockReturnValue(false);
-    mocks.loadCachedTokens.mockReturnValue(HUMAN_TOKENS);
-    mocks.isExpiring.mockReturnValue(true);
-    mocks.refreshTokens.mockRejectedValue(new Error("token expired"));
-
-    const result = await refreshCachedSession();
-
-    expect(result).toEqual({ refreshed: false, reason: "token expired" });
-  });
-});