@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/utils/cognito-session.ts

@@ -1,448 +0,0 @@
-/**
- * Shared Cognito session helpers for hq-cli commands.
- *
- * Consumed by:
- *   - `hq onboard` and `hq sync push|pull` (need token + VaultServiceConfig)
- *   - `hq auth refresh` and the standalone `hq-auth-refresh` bin invoked by
- *     the deploy skill (.claude/skills/deploy/SKILL.md step 4)
- *
- * Defaults point at the shared vault-indigo-hq-prod Cognito pool (canonical
- * post-2026-04-25 cutover; hq-dev remains the staging fallback via env
- * overrides). They mirror tools/vlt-e2e/e2e-create-company-smoke.ts so the
- * CLI and the in-tree demo script stay drift-free. Override any of them via
- * env:
- *
- *   AWS_REGION                 — e.g. us-east-1
- *   HQ_COGNITO_DOMAIN          — Cognito User Pool domain prefix
- *   HQ_COGNITO_CLIENT_ID       — App Client ID
- *   HQ_COGNITO_CALLBACK_PORT   — Loopback OAuth callback port
- *   HQ_VAULT_API_URL           — vault-service API Gateway URL
- */
-
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import * as yaml from "js-yaml";
-import chalk from "chalk";
-import {
-  loadCachedTokens,
-  isExpiring,
-  refreshTokens,
-  browserLogin,
-  detectHqCoreVersion,
-  isMachineIdentity,
-  getValidMachineTokens,
-  type CognitoAuthConfig,
-  type ClientInfo,
-  type VaultServiceConfig,
-} from "@indigoai-us/hq-cloud";
-import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
-
-// Re-export the cached-session primitives for callers that must deliberately
-// avoid the refresh/login behavior in the higher-level helpers below.
-export { isExpiring, isMachineIdentity, loadCachedTokens };
-
-export const DEFAULT_COGNITO: CognitoAuthConfig = {
-  region: process.env.AWS_REGION ?? "us-east-1",
-  userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
-  clientId: process.env.HQ_COGNITO_CLIENT_ID ?? "7acei2c8v870enheptb1j5foln",
-  port: process.env.HQ_COGNITO_CALLBACK_PORT
-    ? Number(process.env.HQ_COGNITO_CALLBACK_PORT)
-    : 8765,
-  // Skip Cognito's Hosted UI — go straight to Google OAuth. The Cognito
-  // /oauth2/authorize endpoint honors `identity_provider` and performs an
-  // internal redirect, so the user never sees the (un-styleable) Hosted UI.
-  // Set HQ_COGNITO_IDENTITY_PROVIDER="" to fall back to the IdP picker for
-  // accounts that use email+password (admin-created users without Google).
-  identityProvider:
-    process.env.HQ_COGNITO_IDENTITY_PROVIDER !== undefined
-      ? process.env.HQ_COGNITO_IDENTITY_PROVIDER || undefined
-      : "Google",
-};
-
-export const DEFAULT_VAULT_API_URL =
-  process.env.HQ_VAULT_API_URL ?? "https://hqapi.hq.computer";
-
-/**
- * Resolve the HQ tree root for cloud-aware subcommands (`hq sync`, `hq onboard`,
- * `hq cloud …`, etc.).
- *
- * Resolution order — mirrors the menubar/installer resolver
- * (`hq-sync` `util/paths.rs::resolve_hq_folder`) so the CLI targets the SAME
- * root the AppBar syncs, regardless of cwd:
- *   1. `$HQ_ROOT` env var — explicit assertion by the caller; short-circuits all.
- *   2. Walk up from `process.cwd()` to the nearest HQ root (working-tree wins:
- *      if you're inside an HQ tree, operate on THAT tree). See {@link isHqRoot}.
- *   3. `~/.hq/menubar.json` → `hqPath` — the canonical record written by the
- *      installer (≥0.1.28) and the menubar's Settings re-tether. Same field HQ
- *      Sync reads first.
- *   4. `~/.hq/config.json` → `hqFolderPath` — legacy installer record.
- *   5. Discovery: scan well-known locations (`~/HQ`, `~/hq`, `~/Documents/HQ`,
- *      …) for a folder carrying a valid `core.yaml` signature. Safety net for
- *      installs that never wrote the path back to menubar.json.
- *   6. Fall back to `~/hq` (the historical CLI default) — or throw, per
- *      `opts.onMissing`.
- *
- * Why tiers 3–5 exist:
- *   Before this, the CLI only knew `$HQ_ROOT` and the cwd walk-up. Run from any
- *   cwd OUTSIDE the HQ tree with `$HQ_ROOT` unset, it fell straight to `~/hq` —
- *   so a user whose HQ lives anywhere else (e.g. `~/Desktop/HQ`, as the AppBar
- *   syncs it) silently got a brand-new `~/hq` stub and a full re-sync into it
- *   (split-brain). Reading the installer/menubar records the way HQ Sync does
- *   closes that gap (feedback_3967e294).
- *
- * Why both markers in the walk-up (tier 2)?
- *   An HQ root has a `core.yaml` (canonical `core/core.yaml` since hq-core v14,
- *   legacy `<root>/core.yaml` before) AND a sibling `companies/` directory. The
- *   synced `core/` subtree ALSO contains a `core.yaml` (the template version
- *   source-of-truth) but NO `companies/`. Requiring `companies/` as well stops
- *   the walk from latching onto `<hqRoot>/core/` (Codex P2 on hq#146).
- *
- * `opts.onMissing` controls the final arm:
- *   - `'fallback'` (default) — return `~/hq` if nothing resolves. Preserves the
- *     module-load contract of `DEFAULT_HQ_ROOT`, pinned by commander.js
- *     `.option()` callers at registration time.
- *   - `'throw'` — throw a user-actionable error. Used by module-management
- *     commands (pkg-*, team-sync) where a silent default-path miss would
- *     target the wrong directory.
- *
- * Evaluated once at module load for `DEFAULT_HQ_ROOT`; the installer/menubar
- * records and cwd are both fixed at process start, so a one-shot read is sound.
- * Re-importable as a function for command-time resolution and tests.
- */
-export function resolveDefaultHqRoot(opts: {
-  onMissing?: "throw" | "fallback";
-} = {}): string {
-  // Tier 1: explicit override.
-  if (process.env.HQ_ROOT) return path.resolve(process.env.HQ_ROOT);
-
-  // Tier 2: working-tree walk-up — operate on the HQ tree you're inside.
-  let cur = path.resolve(process.cwd());
-  while (cur !== path.dirname(cur)) {
-    if (isHqRoot(cur)) return cur;
-    cur = path.dirname(cur);
-  }
-
-  // Tiers 3–4: the installer/menubar's canonical "where is HQ" records.
-  const fromConfig = readHqRootFromHqConfig(path.join(os.homedir(), ".hq"));
-  if (fromConfig) return path.resolve(fromConfig);
-
-  // Tier 5: discover a valid HQ root in the well-known locations.
-  const discovered = discoverHqRootViaCoreYaml();
-  if (discovered) return discovered;
-
-  // Tier 6: nothing resolved.
-  if (opts.onMissing === "throw") {
-    throw new Error(
-      "Could not find HQ root. Run this command from within your HQ directory " +
-        "(must contain core.yaml AND a companies/ subdirectory), set $HQ_ROOT, " +
-        "or install HQ via the installer/menubar so ~/.hq/menubar.json records " +
-        "its location.",
-    );
-  }
-  return path.join(os.homedir(), "hq");
-}
-
-/**
- * Read the configured HQ root from the installer/menubar records under
- * `hqConfigDir` (`~/.hq`). Mirrors HQ Sync's precedence:
- *   1. `menubar.json` → `hqPath` (canonical; written by installer ≥0.1.28 and
- *      the menubar Settings re-tether)
- *   2. `config.json` → `hqFolderPath` (legacy installer flows)
- * Returns the first non-empty string, or undefined. Best-effort: a missing or
- * malformed file is treated as "not configured" (never throws).
- */
-function readHqRootFromHqConfig(hqConfigDir: string): string | undefined {
-  const fromMenubar = readJsonStringField(
-    path.join(hqConfigDir, "menubar.json"),
-    "hqPath",
-  );
-  if (fromMenubar) return fromMenubar;
-  return readJsonStringField(
-    path.join(hqConfigDir, "config.json"),
-    "hqFolderPath",
-  );
-}
-
-/** Read a top-level string field from a JSON file, or undefined on any miss. */
-function readJsonStringField(file: string, field: string): string | undefined {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(file, "utf-8")) as Record<
-      string,
-      unknown
-    >;
-    const value = parsed[field];
-    return typeof value === "string" && value.length > 0 ? value : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-/** Well-known parent locations an HQ tree commonly lives in (mirrors hq-sync). */
-function hqDiscoveryCandidates(): string[] {
-  const home = os.homedir();
-  return [
-    path.join(home, "HQ"),
-    path.join(home, "hq"),
-    path.join(home, "Documents", "HQ"),
-    path.join(home, "Documents", "hq"),
-    path.join(home, "Desktop", "HQ"),
-    path.join(home, "Desktop", "hq"),
-  ];
-}
-
-/**
- * Scan the well-known locations for a folder carrying a valid `core.yaml`
- * signature. First match wins; returns undefined if none qualify. Cheap — a
- * few stats plus one small YAML parse on a hit.
- */
-function discoverHqRootViaCoreYaml(): string | undefined {
-  return hqDiscoveryCandidates().find(isValidHqRootSignature);
-}
-
-/**
- * True iff `dir` carries a valid hq-core `core.yaml` — canonical
- * (`<dir>/core/core.yaml`, hq-core ≥v14) or legacy (`<dir>/core.yaml`) — that
- * parses as YAML and has BOTH the `version` and `hqVersion` fields. The dual
- * field check (matching hq-sync's `is_valid_hq_root`) stops a stray `core.yaml`
- * from another tool from false-matching.
- */
-function isValidHqRootSignature(dir: string): boolean {
-  const canonical = path.join(dir, "core", "core.yaml");
-  const legacy = path.join(dir, "core.yaml");
-  let file: string;
-  if (fileExists(canonical)) file = canonical;
-  else if (fileExists(legacy)) file = legacy;
-  else return false;
-  try {
-    const parsed = yaml.load(fs.readFileSync(file, "utf-8")) as
-      | Record<string, unknown>
-      | null
-      | undefined;
-    return (
-      !!parsed &&
-      typeof parsed === "object" &&
-      "version" in parsed &&
-      "hqVersion" in parsed
-    );
-  } catch {
-    return false;
-  }
-}
-
-/** True iff `p` exists and is a regular file. */
-function fileExists(p: string): boolean {
-  try {
-    return fs.statSync(p).isFile();
-  } catch {
-    return false;
-  }
-}
-
-/**
- * True iff `dir` is an HQ root for the cwd walk-up: it has a `core.yaml`
- * (canonical `core/core.yaml` since hq-core v14, or legacy `<dir>/core.yaml`)
- * AND a sibling `companies/` directory. The `companies/` discriminator keeps
- * the walk from latching onto the inner `core/` subtree, which carries its own
- * `core.yaml` but no `companies/`.
- */
-function isHqRoot(dir: string): boolean {
-  const hasCoreYaml =
-    fileExists(path.join(dir, "core", "core.yaml")) ||
-    fileExists(path.join(dir, "core.yaml"));
-  if (!hasCoreYaml) return false;
-  try {
-    return fs.statSync(path.join(dir, "companies")).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
-export const DEFAULT_HQ_ROOT = resolveDefaultHqRoot();
-
-/**
- * Return a non-expired Cognito access token, refreshing or browser-logging-in
- * as needed. Cache lives at ~/.hq/cognito-tokens.json.
- *
- * Pass `interactive: false` from automated contexts (e.g. the `hq-auth-refresh`
- * bin invoked by the deploy skill) where failing fast is better than opening
- * a browser.
- */
-export async function ensureCognitoToken(options: {
-  interactive?: boolean;
-} = {}): Promise<string> {
-  const interactive = options.interactive ?? true;
-
-  // Machine identities (company agents) mint sessions on demand via
-  // USER_PASSWORD_AUTH — no refresh-token dance, no browser. The vault API's
-  // JWT authorizer accepts ID tokens, and the agent's identity claims
-  // (custom:entityType=agent, custom:entityUid=agt_*) ride the ID token ONLY,
-  // so vault-API calls from a machine identity send the ID token. The cached
-  // token file keeps correct field semantics (real access token in
-  // accessToken) for consumers that need token_use=access, e.g. the deploy
-  // API via the deploy skill.
-  if (isMachineIdentity()) {
-    const machine = await getValidMachineTokens(DEFAULT_COGNITO);
-    return machine.idToken;
-  }
-
-  const cached = loadCachedTokens();
-
-  if (cached && !isExpiring(cached, 120)) {
-    return cached.accessToken;
-  }
-
-  if (cached) {
-    try {
-      if (interactive) {
-        console.error(chalk.dim("  Refreshing expiring HQ session..."));
-      }
-      const refreshed = await refreshTokens(DEFAULT_COGNITO, cached.refreshToken);
-      return refreshed.accessToken;
-    } catch (err) {
-      if (interactive) {
-        console.error(
-          chalk.dim(
-            `  Refresh failed (${err instanceof Error ? err.message : err}), falling back to browser login`,
-          ),
-        );
-      }
-    }
-  }
-
-  if (!interactive) {
-    throw new Error(
-      "No valid HQ session and interactive login is disabled. Run `hq login` first.",
-    );
-  }
-
-  console.error(chalk.cyan("  No cached HQ session — launching browser sign-in..."));
-  const tokens = await browserLogin(DEFAULT_COGNITO);
-  return tokens.accessToken;
-}
-
-/**
- * Return a non-expired Cognito **ID** token (mirrors `ensureCognitoToken`'s
- * refresh/login flow but yields the id_token, not the access token).
- *
- * Staff-gated vault-API routes (`assertStaffCaller`) read the `email` claim,
- * which Cognito puts on the ID token ONLY — the access token has no `email`, so
- * sending it returns `403 NO_EMAIL_CLAIM`. Callers performing a staff action
- * (e.g. `hq publish --as <handle>`) MUST send the ID token. For machine
- * identities the vault API already authenticates with the ID token, so this is
- * identical to `ensureCognitoToken` there.
- */
-export async function ensureCognitoIdToken(options: {
-  interactive?: boolean;
-} = {}): Promise<string> {
-  const interactive = options.interactive ?? true;
-
-  if (isMachineIdentity()) {
-    const machine = await getValidMachineTokens(DEFAULT_COGNITO);
-    return machine.idToken;
-  }
-
-  const cached = loadCachedTokens();
-
-  if (cached && !isExpiring(cached, 120)) {
-    return cached.idToken;
-  }
-
-  if (cached) {
-    try {
-      if (interactive) {
-        console.error(chalk.dim("  Refreshing expiring HQ session..."));
-      }
-      const refreshed = await refreshTokens(DEFAULT_COGNITO, cached.refreshToken);
-      return refreshed.idToken;
-    } catch (err) {
-      if (interactive) {
-        console.error(
-          chalk.dim(
-            `  Refresh failed (${err instanceof Error ? err.message : err}), falling back to browser login`,
-          ),
-        );
-      }
-    }
-  }
-
-  if (!interactive) {
-    throw new Error(
-      "No valid HQ session and interactive login is disabled. Run `hq login` first.",
-    );
-  }
-
-  console.error(chalk.cyan("  No cached HQ session — launching browser sign-in..."));
-  const tokens = await browserLogin(DEFAULT_COGNITO);
-  return tokens.idToken;
-}
-
-/**
- * The CLI's own ClientInfo. Resolved once at module load so every VaultClient
- * built in this process stamps the same name/version onto its requests.
- *
- * `hqCoreVersion` is filled in lazily by walking up from cwd to find
- * `core/core.yaml` — present only when the CLI is invoked from inside an
- * hq-core checkout, so the server can see scaffold-generation skew.
- */
-export const CLI_CLIENT_INFO: ClientInfo = {
-  name: CLI_NAME,
-  version: CLI_VERSION,
-  hqCoreVersion: detectHqCoreVersion(),
-};
-
-/** Build a VaultServiceConfig with the given access token. */
-export function buildVaultConfig(authToken: string): VaultServiceConfig {
-  return {
-    apiUrl: DEFAULT_VAULT_API_URL,
-    authToken,
-    region: DEFAULT_COGNITO.region,
-    clientInfo: CLI_CLIENT_INFO,
-  };
-}
-
-/**
- * Ensure a valid cached Cognito session exists right now, non-interactively,
- * and return the result. Used by `hq auth refresh` and the `hq-auth-refresh`
- * bin. `refreshed: true` means a valid session is ensured now from a healthy
- * cache hit, a token refresh, or a machine-token mint. `refreshed: false`
- * means no valid session could be ensured non-interactively; the caller gets a
- * reason string and can decide what to do next. Never opens a browser.
- */
-export async function refreshCachedSession(): Promise<{
-  refreshed: boolean;
-  reason?: string;
-}> {
-  // Machine identities have no refresh token; ensure a valid cached machine
-  // session without forcing a re-mint when the cache is already healthy.
-  if (isMachineIdentity()) {
-    try {
-      await getValidMachineTokens(DEFAULT_COGNITO);
-      return { refreshed: true };
-    } catch (err) {
-      return {
-        refreshed: false,
-        reason: err instanceof Error ? err.message : String(err),
-      };
-    }
-  }
-
-  const cached = loadCachedTokens();
-  if (!cached) {
-    return { refreshed: false, reason: "no cached session" };
-  }
-
-  if (!isExpiring(cached, 120)) {
-    return { refreshed: true };
-  }
-
-  try {
-    await refreshTokens(DEFAULT_COGNITO, cached.refreshToken);
-    return { refreshed: true };
-  } catch (err) {
-    return {
-      refreshed: false,
-      reason: err instanceof Error ? err.message : String(err),
-    };
-  }
-}

package/src/utils/company-selection-error.test.ts

@@ -1,42 +0,0 @@
-import { describe, it, expect } from "vitest";
-import {
-  CompanySelectionError,
-  isCompanySelectionError,
-} from "./company-selection-error.js";
-
-describe("isCompanySelectionError", () => {
-  // HQ-CLI-7: the exact error that flooded Sentry when a user with multiple
-  // active memberships ran a command with no --company.
-  it("classifies a CompanySelectionError as a selection prompt (skip Sentry)", () => {
-    const err = new CompanySelectionError(
-      "Multiple active companies found. Re-run with --company <slug-or-uid> to pick one:\n  --company cmp_a\n  --company cmp_b",
-    );
-    expect(isCompanySelectionError(err)).toBe(true);
-  });
-
-  it("preserves the user-facing message verbatim for the top-level handler", () => {
-    const msg = "No active company memberships found. Use --company <slug> to specify.";
-    expect(new CompanySelectionError(msg).message).toBe(msg);
-  });
-
-  it("keeps instanceof across the transpile target", () => {
-    const err = new CompanySelectionError("pick one");
-    expect(err).toBeInstanceOf(CompanySelectionError);
-    expect(err).toBeInstanceOf(Error);
-    expect(err.name).toBe("CompanySelectionError");
-  });
-
-  // A genuine defect must still reach Sentry — only the disambiguation class is
-  // diverted, so real bugs are never silently swallowed.
-  it("does NOT match a plain Error (so real faults still report)", () => {
-    expect(isCompanySelectionError(new Error("Multiple active companies found."))).toBe(false);
-    expect(isCompanySelectionError(new Error("boom"))).toBe(false);
-  });
-
-  it("does NOT match non-error values", () => {
-    expect(isCompanySelectionError(null)).toBe(false);
-    expect(isCompanySelectionError(undefined)).toBe(false);
-    expect(isCompanySelectionError("Multiple active companies found.")).toBe(false);
-    expect(isCompanySelectionError({ message: "pick one" })).toBe(false);
-  });
-});

package/src/utils/company-selection-error.ts

@@ -1,45 +0,0 @@
-// src/utils/company-selection-error.ts
-//
-// Classify the "the caller must pick a company with --company" conditions
-// (HQ-CLI-7). These are expected, user-actionable disambiguation prompts —
-// NOT hq-cli defects — so the top-level catch prints the message and exits
-// non-zero but SKIPS Sentry capture, mirroring the EPIPE (HQ-6B),
-// intercepted-process-exit (HQ-CLI-3), and environmental-FS (HQ-CLI-2)
-// carve-outs.
-//
-// HQ-CLI-7: a user with THREE active company memberships ran `hq integrations`
-// with no `--company`. `resolveCompanyFromMemberships` correctly threw
-// "Multiple active companies found. Re-run with --company <slug-or-uid>…" —
-// the message literally tells the user how to proceed — but it propagated to
-// the CLI's top-level handler as a plain Error and was shipped to Sentry as a
-// fatal. The command needs the human to disambiguate; the code cannot pick a
-// company for them, so this is normal usage, not a crash to triage.
-
-/**
- * Thrown when the CLI cannot resolve a single company on the user's behalf and
- * the user must re-run with `--company <slug-or-uid>`:
- *   - they have multiple active memberships and passed no `--company`,
- *   - they have no active membership and passed no `--company`, or
- *   - a `--company` slug collides across companies, none in their namespace.
- *
- * The `message` is already user-facing and actionable — the top-level handler
- * prints it verbatim and skips Sentry capture.
- */
-export class CompanySelectionError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "CompanySelectionError";
-    // Preserve `instanceof` across the TS→ES5/ES2015 transpile target.
-    Object.setPrototypeOf(this, CompanySelectionError.prototype);
-  }
-}
-
-/**
- * True when `err` is a company-selection disambiguation prompt the user must
- * resolve with `--company`. Callers should print `err.message` and SKIP Sentry
- * capture (expected usage, no defect) while preserving a non-zero exit. Genuine
- * faults are plain `Error`s and return `false`, so real bugs still report.
- */
-export function isCompanySelectionError(err: unknown): boolean {
-  return err instanceof CompanySelectionError;
-}

package/src/utils/contribution-table.ts

@@ -1,83 +0,0 @@
-/**
- * The contribution registry -- the SINGLE declarative source of truth (US-003)
- * for the `contributes.* -> host` mapping. Every other surface DERIVES from
- * this table:
- *
- *   - `PackContributeKey` (types.ts)              = `keyof typeof CONTRIBUTION_TABLE`
- *   - `linkFor` / `contributionLinks`             read `payload` + `host`
- *   - `validateManifest`'s payload check          reads `payload`
- *   - `core/scripts/scan-packages.sh`             reads a data block GENERATED
- *                                                 from this table
- *                                                 (scripts/generate-scan-packages-table.mjs)
- *
- * Adding a contribution type is ONE row here, not a five-site edit. The parity
- * test (`pack-contributions.test.ts`) asserts every surface agrees on the full
- * key-set, the payload suffix, and the wire mode.
- *
- * Row fields:
- *   - `payload`: path INSIDE the pack, with the literal token `{item}` for the
- *     declared name. The suffix after `{item}` (e.g. `.md`, `.json`, or none)
- *     IS the load-bearing per-key shape.
- *   - `host`: for `wire: 'symlink'`, the host DIRECTORY (relative to the HQ
- *     root) the symlink is created under -- the symlink dst is
- *     `<host>/<expanded-item-basename>`. For `wire: 'merge'`, a non-path
- *     SENTINEL describing the merge target (e.g. `merge:claude+codex`); it is
- *     NEVER used as a filesystem path.
- *   - `wire`: `symlink` (a single `ln -s` into `host`) or `merge` (merged into
- *     a shared host config; see US-004/US-005). Symlink-only readers MUST skip
- *     `merge` rows.
- *
- * NOTE: the `mcp` row is DECLARED here as data only. US-003 does NOT wire any
- * MCP behavior -- the merge engine lands in US-004/US-005. Declaring it now
- * makes the table the single source so adding the merge wiring is a code change
- * against an already-present row, and the parity test guards it from day one.
- */
-
-export type WireMode = 'symlink' | 'merge';
-
-export interface ContributionRow {
-  /** Path inside the pack, with `{item}` substituted for the declared name. */
-  payload: string;
-  /**
-   * `wire: 'symlink'` -> host directory the symlink lives under (HQ-root
-   * relative). `wire: 'merge'` -> a non-path sentinel for the merge target.
-   */
-  host: string;
-  wire: WireMode;
-}
-
-/**
- * The 8-key contribution registry. `as const` so `keyof typeof` yields the
- * exact literal key union consumed by `PackContributeKey`.
- */
-export const CONTRIBUTION_TABLE = {
-  workers: { payload: 'workers/{item}', host: 'core/workers/public', wire: 'symlink' },
-  knowledge: { payload: 'knowledge/{item}', host: 'core/knowledge/public', wire: 'symlink' },
-  skills: { payload: 'skills/{item}', host: '.claude/skills', wire: 'symlink' },
-  commands: { payload: 'commands/{item}.md', host: '.claude/commands', wire: 'symlink' },
-  hooks: { payload: 'hooks/{item}.sh', host: '.claude/hooks', wire: 'symlink' },
-  policies: { payload: 'policies/{item}.md', host: 'core/policies', wire: 'symlink' },
-  scripts: { payload: 'scripts/{item}', host: 'core/scripts', wire: 'symlink' },
-  // wire:merge -- DECLARED as data (US-003); the merge engine ships in
-  // US-004/US-005. Symlink readers skip this row.
-  mcp: { payload: 'mcp/{item}.json', host: 'merge:claude+codex', wire: 'merge' },
-} as const satisfies Record<string, ContributionRow>;
-
-/** The declared contribution keys, derived once from the table. */
-export type ContributionKey = keyof typeof CONTRIBUTION_TABLE;
-
-/** All contribution keys, in declaration order. */
-export const CONTRIBUTION_KEYS = Object.keys(CONTRIBUTION_TABLE) as ContributionKey[];
-
-/**
- * Expand a row's `payload` template for a concrete item name. Returns the
- * pack-relative path of the contribution's payload (e.g. `commands/foo.md`).
- */
-export function payloadFor(key: ContributionKey, item: string): string {
-  return CONTRIBUTION_TABLE[key].payload.replace('{item}', item);
-}
-
-/** Keys whose contributions are wired by a host symlink (skip `merge` rows). */
-export const SYMLINK_KEYS = CONTRIBUTION_KEYS.filter(
-  (k) => CONTRIBUTION_TABLE[k].wire === 'symlink',
-);

package/src/utils/environmental-error.test.ts

@@ -1,45 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { environmentalFsErrorMessage } from "./environmental-error.js";
-
-/** Build a Node-style errno error with a `.code`, as fs.*Sync throws. */
-function errnoError(code: string, message: string): NodeJS.ErrnoException {
-  const err = new Error(message) as NodeJS.ErrnoException;
-  err.code = code;
-  return err;
-}
-
-describe("environmentalFsErrorMessage", () => {
-  // HQ-CLI-2: the exact error that crashed `hq reindex` and flooded Sentry.
-  it("classifies ENOSPC (no space left on device) as environmental", () => {
-    const err = errnoError("ENOSPC", "ENOSPC: no space left on device, open '/x'");
-    const msg = environmentalFsErrorMessage(err);
-    expect(msg).not.toBeNull();
-    expect(msg).toMatch(/no space left on device/i);
-  });
-
-  it("classifies EDQUOT (quota exceeded) as environmental", () => {
-    const msg = environmentalFsErrorMessage(errnoError("EDQUOT", "EDQUOT: disk quota exceeded"));
-    expect(msg).toMatch(/quota/i);
-  });
-
-  it("classifies EROFS (read-only filesystem) as environmental", () => {
-    const msg = environmentalFsErrorMessage(errnoError("EROFS", "EROFS: read-only file system"));
-    expect(msg).toMatch(/read-only/i);
-  });
-
-  // A genuine code bug must still reach Sentry — only the disk-class codes are
-  // diverted, so we never silently swallow real defects.
-  it("returns null for a code-bug error (ENOENT) so it is still captured", () => {
-    expect(environmentalFsErrorMessage(errnoError("ENOENT", "ENOENT: not found"))).toBeNull();
-  });
-
-  it("returns null for a plain Error with no code", () => {
-    expect(environmentalFsErrorMessage(new Error("boom"))).toBeNull();
-  });
-
-  it("returns null for non-error values (null/undefined/string)", () => {
-    expect(environmentalFsErrorMessage(null)).toBeNull();
-    expect(environmentalFsErrorMessage(undefined)).toBeNull();
-    expect(environmentalFsErrorMessage("ENOSPC")).toBeNull();
-  });
-});