@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/utils/feedback-screenshots.ts

@@ -1,124 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { vaultApiFetch } from "./vault-api.js";
-
-export const MAX_SCREENSHOTS = 5;
-// Per-image ceiling. Screenshots are PNG/JPEG captures; 10 MB is generous.
-export const MAX_SCREENSHOT_BYTES = 10 * 1024 * 1024;
-
-// Extension → content type. Must stay in sync with the server's allowed set
-// (hq-pro feedback-screenshots.ts ALLOWED_CONTENT_TYPES).
-const EXT_CONTENT_TYPE: Record<string, string> = {
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".webp": "image/webp",
-  ".gif": "image/gif",
-};
-
-export function contentTypeForPath(filePath: string): string {
-  const ext = path.extname(filePath).toLowerCase();
-  const contentType = EXT_CONTENT_TYPE[ext];
-  if (!contentType) {
-    throw new Error(
-      `unsupported screenshot type: ${filePath} (allowed: ${Object.keys(EXT_CONTENT_TYPE).join(", ")})`,
-    );
-  }
-  return contentType;
-}
-
-export interface ScreenshotInput {
-  path: string;
-  contentType: string;
-  bytes: Buffer;
-}
-
-/** Validate + read the given screenshot paths (count, type, existence, size). */
-export function loadScreenshots(paths: string[]): ScreenshotInput[] {
-  if (paths.length > MAX_SCREENSHOTS) {
-    throw new Error(
-      `at most ${MAX_SCREENSHOTS} screenshots are allowed (got ${paths.length})`,
-    );
-  }
-  return paths.map((filePath) => {
-    const contentType = contentTypeForPath(filePath);
-    let bytes: Buffer;
-    try {
-      bytes = fs.readFileSync(filePath);
-    } catch {
-      throw new Error(`cannot read screenshot: ${filePath}`);
-    }
-    if (bytes.byteLength === 0) {
-      throw new Error(`screenshot is empty: ${filePath}`);
-    }
-    if (bytes.byteLength > MAX_SCREENSHOT_BYTES) {
-      throw new Error(
-        `screenshot too large: ${filePath} (${bytes.byteLength} bytes, max ${MAX_SCREENSHOT_BYTES})`,
-      );
-    }
-    return { path: filePath, contentType, bytes };
-  });
-}
-
-interface PresignResponse {
-  screenshots: Array<{ key: string; url: string; contentType: string }>;
-}
-
-/**
- * Validate the screenshot paths, request presigned PUT URLs from the feedback
- * endpoint, upload each image direct to S3, and return the object keys to
- * attach to the feedback submission. Returns [] for no screenshots.
- *
- * `fetchImpl` is injectable for tests; defaults to the global fetch.
- */
-export async function uploadScreenshots(opts: {
-  paths: string[];
-  token: string;
-  fetchImpl?: typeof fetch;
-}): Promise<string[]> {
-  if (opts.paths.length === 0) return [];
-  const inputs = loadScreenshots(opts.paths);
-
-  const res = await vaultApiFetch({
-    token: opts.token,
-    path: "/v1/feedback/screenshots/presign",
-    method: "POST",
-    body: { contentTypes: inputs.map((i) => i.contentType) },
-  });
-  if (!res.ok) {
-    const data = await res.json().catch(() => ({}));
-    const msg =
-      data &&
-      typeof data === "object" &&
-      typeof (data as { error?: unknown }).error === "string"
-        ? (data as { error: string }).error
-        : res.statusText;
-    throw new Error(`Failed to presign screenshots: ${msg}`);
-  }
-  const parsed = (await res.json()) as PresignResponse;
-  if (
-    !parsed ||
-    !Array.isArray(parsed.screenshots) ||
-    parsed.screenshots.length !== inputs.length
-  ) {
-    throw new Error("Presign response did not match the requested screenshots");
-  }
-
-  const doFetch = opts.fetchImpl ?? fetch;
-  const keys: string[] = [];
-  for (let i = 0; i < inputs.length; i++) {
-    const slot = parsed.screenshots[i]!;
-    const put = await doFetch(slot.url, {
-      method: "PUT",
-      headers: { "Content-Type": slot.contentType },
-      body: inputs[i]!.bytes,
-    });
-    if (!put.ok) {
-      throw new Error(
-        `Failed to upload screenshot ${inputs[i]!.path}: HTTP ${put.status}`,
-      );
-    }
-    keys.push(slot.key);
-  }
-  return keys;
-}

package/src/utils/feedback-versions.test.ts

@@ -1,98 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-
-vi.mock("./manifest.js", () => ({
-  findHqRoot: vi.fn(() => "/fake/hq"),
-}));
-vi.mock("./pack-contributions.js", () => ({
-  readHqVersion: vi.fn(() => "15.0.20"),
-}));
-
-import { findHqRoot } from "./manifest.js";
-import { readHqVersion } from "./pack-contributions.js";
-import { CLI_VERSION } from "../cli-version.js";
-import {
-  collectVersions,
-  readCoreVersion,
-  readSyncVersion,
-} from "./feedback-versions.js";
-
-describe("readSyncVersion", () => {
-  let tmpHome: string;
-
-  beforeEach(() => {
-    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "hqsync-"));
-    fs.mkdirSync(path.join(tmpHome, ".hq"), { recursive: true });
-  });
-  afterEach(() => {
-    fs.rmSync(tmpHome, { recursive: true, force: true });
-  });
-
-  function writeMarker(contents: string): void {
-    fs.writeFileSync(path.join(tmpHome, ".hq", "sync-version.json"), contents);
-  }
-
-  it("reads the version the hq-sync app records", () => {
-    writeMarker(JSON.stringify({ version: "0.8.22-beta.1", updatedAt: "x" }));
-    expect(readSyncVersion(tmpHome)).toBe("0.8.22-beta.1");
-  });
-
-  it("returns null when the marker file is absent (hq-sync not installed)", () => {
-    expect(readSyncVersion(tmpHome)).toBeNull();
-  });
-
-  it("returns null on malformed JSON rather than throwing", () => {
-    writeMarker("{ not json");
-    expect(readSyncVersion(tmpHome)).toBeNull();
-  });
-
-  it("returns null when version is missing or not a non-empty string", () => {
-    writeMarker(JSON.stringify({ updatedAt: "x" }));
-    expect(readSyncVersion(tmpHome)).toBeNull();
-    writeMarker(JSON.stringify({ version: "" }));
-    expect(readSyncVersion(tmpHome)).toBeNull();
-    writeMarker(JSON.stringify({ version: 123 }));
-    expect(readSyncVersion(tmpHome)).toBeNull();
-  });
-});
-
-describe("readCoreVersion", () => {
-  beforeEach(() => {
-    vi.mocked(findHqRoot).mockReset().mockReturnValue("/fake/hq");
-    vi.mocked(readHqVersion).mockReset().mockReturnValue("15.0.20");
-  });
-
-  it("reads hqVersion from the resolved HQ root", () => {
-    expect(readCoreVersion()).toBe("15.0.20");
-    expect(readHqVersion).toHaveBeenCalledWith("/fake/hq");
-  });
-
-  it("returns null (never throws) when resolution fails", () => {
-    vi.mocked(findHqRoot).mockImplementation(() => {
-      throw new Error("no hq root");
-    });
-    expect(readCoreVersion()).toBeNull();
-  });
-
-  it("returns null when core.yaml has no hqVersion", () => {
-    vi.mocked(readHqVersion).mockReturnValue(null);
-    expect(readCoreVersion()).toBeNull();
-  });
-});
-
-describe("collectVersions", () => {
-  beforeEach(() => {
-    vi.mocked(findHqRoot).mockReset().mockReturnValue("/fake/hq");
-    vi.mocked(readHqVersion).mockReset().mockReturnValue("15.0.20");
-  });
-
-  it("always reports the cli version and best-effort core/sync", () => {
-    const versions = collectVersions();
-    expect(versions.cli).toBe(CLI_VERSION);
-    expect(versions.core).toBe("15.0.20");
-    // sync reads the real homedir marker, which won't exist in CI → null.
-    expect(["string", "object"]).toContain(typeof versions.sync); // string | null
-  });
-});

package/src/utils/feedback-versions.ts

@@ -1,68 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { CLI_VERSION } from "../cli-version.js";
-import { findHqRoot } from "./manifest.js";
-import { readHqVersion } from "./pack-contributions.js";
-
-/**
- * The three HQ component versions captured from the submitter's environment
- * and attached to a feedback submission so triage can see exactly which
- * versions a report came from.
- *
- *   - `cli`  — this hq-cli build (always known).
- *   - `core` — the HQ scaffold version from `core/core.yaml` (`hqVersion`);
- *               null when the command runs outside an HQ tree.
- *   - `sync` — the installed hq-sync menubar app version, which the app
- *               records at `~/.hq/sync-version.json` on startup; null when
- *               hq-sync is not installed (e.g. CLI-only / CI environments).
- */
-export interface VersionInfo {
-  cli: string;
-  core: string | null;
-  sync: string | null;
-}
-
-/**
- * Best-effort read of the hq-core scaffold version (`core/core.yaml`
- * `hqVersion`). Resolves the HQ root from the working directory; returns
- * null when no HQ root / core.yaml is found rather than throwing — version
- * capture must never break a feedback submission.
- */
-export function readCoreVersion(): string | null {
-  try {
-    return readHqVersion(findHqRoot());
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Best-effort read of the hq-sync menubar app version. The app writes
- * `{ version, updatedAt }` to `~/.hq/sync-version.json` on startup; the CLI
- * reads it here. Returns null when the file is absent or malformed (hq-sync
- * not installed, or an older build that predates the marker).
- */
-export function readSyncVersion(homeDir: string = os.homedir()): string | null {
-  try {
-    const raw = fs.readFileSync(
-      path.join(homeDir, ".hq", "sync-version.json"),
-      "utf-8",
-    );
-    const parsed = JSON.parse(raw) as { version?: unknown };
-    return typeof parsed.version === "string" && parsed.version.length > 0
-      ? parsed.version
-      : null;
-  } catch {
-    return null;
-  }
-}
-
-/** Collect all three component versions, each independently best-effort. */
-export function collectVersions(): VersionInfo {
-  return {
-    cli: CLI_VERSION,
-    core: readCoreVersion(),
-    sync: readSyncVersion(),
-  };
-}

package/src/utils/git.ts

@@ -1,74 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-import simpleGit, { SimpleGit } from 'simple-git';
-
-export async function cloneRepo(repoUrl: string, targetDir: string, branch?: string): Promise<void> {
-  const git = simpleGit();
-  const options = branch ? ['--branch', branch] : [];
-  await git.clone(repoUrl, targetDir, options);
-}
-
-export async function fetchRepo(repoDir: string): Promise<void> {
-  const git = simpleGit(repoDir);
-  await git.fetch(['--all']);
-}
-
-export async function pullRepo(repoDir: string): Promise<void> {
-  const git = simpleGit(repoDir);
-  await git.pull();
-}
-
-export async function getCurrentCommit(repoDir: string): Promise<string> {
-  const git = simpleGit(repoDir);
-  const log = await git.log({ maxCount: 1 });
-  return log.latest?.hash ?? '';
-}
-
-export async function checkoutCommit(repoDir: string, commitSha: string): Promise<void> {
-  const git = simpleGit(repoDir);
-  await git.checkout(commitSha);
-}
-
-export async function isRepo(dir: string): Promise<boolean> {
-  if (!fs.existsSync(dir)) return false;
-  try {
-    const git = simpleGit(dir);
-    return await git.checkIsRepo();
-  } catch {
-    return false;
-  }
-}
-
-export async function getRemoteUrl(repoDir: string): Promise<string | null> {
-  try {
-    const git = simpleGit(repoDir);
-    const remotes = await git.getRemotes(true);
-    const origin = remotes.find(r => r.name === 'origin');
-    return origin?.refs?.fetch ?? null;
-  } catch {
-    return null;
-  }
-}
-
-export async function isBehindRemote(repoDir: string): Promise<{ behind: boolean; commits: number }> {
-  try {
-    const git = simpleGit(repoDir);
-    await git.fetch();
-    const status = await git.status();
-    return { behind: status.behind > 0, commits: status.behind };
-  } catch {
-    return { behind: false, commits: 0 };
-  }
-}
-
-export function ensureGitignore(hqRoot: string, entry: string): void {
-  const gitignorePath = path.join(hqRoot, '.gitignore');
-  let content = '';
-  if (fs.existsSync(gitignorePath)) {
-    content = fs.readFileSync(gitignorePath, 'utf-8');
-  }
-  if (!content.includes(entry)) {
-    content = content.trimEnd() + '\n' + entry + '\n';
-    fs.writeFileSync(gitignorePath, content);
-  }
-}

package/src/utils/integrity.ts

@@ -1,59 +0,0 @@
-/**
- * Integrity verification — SHA256 hash and RSA signature checks (US-005)
- */
-
-import * as crypto from 'crypto';
-import * as fs from 'fs';
-import * as path from 'path';
-import { resolveDefaultHqRoot } from './cognito-session.js';
-
-/**
- * Verify a file's SHA256 hash matches the expected value.
- */
-export async function computeSha256(filePath: string): Promise<string> {
-  return new Promise((resolve, reject) => {
-    const hash = crypto.createHash('sha256');
-    const stream = fs.createReadStream(filePath);
-
-    stream.on('data', (chunk) => hash.update(chunk));
-    stream.on('end', () => resolve(hash.digest('hex')));
-    stream.on('error', reject);
-  });
-}
-
-/**
- * Verify a file's SHA256 hash matches the expected value.
- */
-export async function verifySha256(
-  filePath: string,
-  expectedHash: string
-): Promise<boolean> {
-  const computed = await computeSha256(filePath);
-  return computed === expectedHash.toLowerCase();
-}
-
-/**
- * Verify an RSA signature of a SHA256 hash using the registry public key.
- * The public key is expected at packages/.keys/registry-public.pem.
- * Returns false (does not throw) if the key file is missing.
- */
-export function verifyRsaSignature(
-  sha256Hash: string,
-  signature: string,
-  publicKeyPath?: string
-): boolean {
-  const keyPath =
-    publicKeyPath ??
-    path.resolve(resolveDefaultHqRoot({ onMissing: 'throw' }), 'packages', '.keys', 'registry-public.pem');
-
-  if (!fs.existsSync(keyPath)) {
-    return false;
-  }
-
-  const publicKey = fs.readFileSync(keyPath, 'utf-8');
-  const verifier = crypto.createVerify('SHA256');
-  verifier.update(sha256Hash);
-  verifier.end();
-
-  return verifier.verify(publicKey, Buffer.from(signature, 'base64'));
-}

package/src/utils/intercepted-process-exit.test.ts

@@ -1,37 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { isInterceptedProcessExit } from "./intercepted-process-exit.js";
-
-describe("isInterceptedProcessExit", () => {
-  it("matches the fuzz harness's intercepted-process.exit marker error", () => {
-    expect(isInterceptedProcessExit(new Error("fuzz-intercepted-process-exit"))).toBe(true);
-  });
-
-  it("matches when the marker is wrapped in a longer message", () => {
-    expect(
-      isInterceptedProcessExit(new Error("audit: fuzz-intercepted-process-exit code=1")),
-    ).toBe(true);
-  });
-
-  it("matches a plain object carrying the marker message", () => {
-    expect(isInterceptedProcessExit({ message: "fuzz-intercepted-process-exit" })).toBe(true);
-  });
-
-  it("matches a bare string carrying the marker", () => {
-    expect(isInterceptedProcessExit("fuzz-intercepted-process-exit")).toBe(true);
-  });
-
-  it("does NOT match genuine errors (so real faults still report)", () => {
-    expect(isInterceptedProcessExit(new Error("boom"))).toBe(false);
-    expect(isInterceptedProcessExit(new Error("ENOENT: no such file or directory"))).toBe(false);
-    expect(isInterceptedProcessExit(Object.assign(new Error("nope"), { code: "EACCES" }))).toBe(
-      false,
-    );
-  });
-
-  it("does NOT match non-error values", () => {
-    expect(isInterceptedProcessExit(null)).toBe(false);
-    expect(isInterceptedProcessExit(undefined)).toBe(false);
-    expect(isInterceptedProcessExit(42)).toBe(false);
-    expect(isInterceptedProcessExit({})).toBe(false);
-  });
-});

package/src/utils/intercepted-process-exit.ts

@@ -1,36 +0,0 @@
-// src/utils/intercepted-process-exit.ts
-//
-// Classify the "intercepted process.exit" synthetic error (HQ-CLI-3).
-//
-// Security/audit FUZZ harnesses (e.g. `/opt/audit/fuzz-exports.js`) monkey-patch
-// `process.exit` to THROW a marker instead of actually terminating, so the
-// fuzzer can keep exercising a binary's entrypoints. When such a harness drives
-// `hq` (e.g. `hq <unknown-command>`), commander legitimately calls
-// `process.exit(1)` — and the patched exit turns that normal CLI control-flow
-// into a thrown `Error: fuzz-intercepted-process-exit` that propagates out of
-// `program.parseAsync()` into the CLI's top-level catch, which then shipped it to
-// Sentry as a fatal.
-//
-// This is a test-harness artifact, NOT an hq-cli defect: a real user's
-// `process.exit` exits the process and nothing is ever thrown or captured.
-// There is no user-facing degradation to fix, so the top-level catch skips
-// Sentry capture for it — the genuine "expected, non-actionable" carve-out,
-// mirroring the EPIPE (HQ-6B) and environmental-FS (HQ-CLI-2) carve-outs.
-
-/** The marker a fuzz/audit harness throws in place of a real `process.exit`. */
-const INTERCEPTED_PROCESS_EXIT_MARKER = "fuzz-intercepted-process-exit";
-
-/**
- * True when `err` is a fuzz/audit harness's intercepted-`process.exit` marker
- * rather than a genuine fault. Callers should SKIP Sentry capture (no defect, no
- * user-facing degradation) while preserving the intended exit code.
- */
-export function isInterceptedProcessExit(err: unknown): boolean {
-  if (typeof err === "object" && err !== null) {
-    const message = (err as { message?: unknown }).message;
-    if (typeof message === "string" && message.includes(INTERCEPTED_PROCESS_EXIT_MARKER)) {
-      return true;
-    }
-  }
-  return typeof err === "string" && err.includes(INTERCEPTED_PROCESS_EXIT_MARKER);
-}

package/src/utils/login-provider.test.ts

@@ -1,42 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("./cognito-session.js", () => ({
-  DEFAULT_COGNITO: {
-    region: "us-east-1",
-    userPoolDomain: "vault-indigo-hq-prod",
-    clientId: "client-123",
-    port: 8765,
-    identityProvider: "Google",
-  },
-}));
-
-import {
-  cognitoConfigForLoginProvider,
-  parseLoginProvider,
-} from "./login-provider.js";
-
-describe("login provider helpers", () => {
-  it("preserves the default Cognito config when no provider is supplied", () => {
-    expect(cognitoConfigForLoginProvider(undefined).identityProvider).toBe("Google");
-  });
-
-  it("maps Microsoft to the Cognito MicrosoftPersonal IdP", () => {
-    expect(cognitoConfigForLoginProvider("microsoft").identityProvider).toBe(
-      "MicrosoftPersonal",
-    );
-  });
-
-  it("maps picker to no forced IdP", () => {
-    expect(cognitoConfigForLoginProvider("picker").identityProvider).toBeUndefined();
-  });
-
-  it("accepts provider values case-insensitively", () => {
-    expect(parseLoginProvider("Microsoft")).toBe("microsoft");
-  });
-
-  it("rejects unknown providers", () => {
-    expect(() => parseLoginProvider("github")).toThrow(
-      "Provider must be one of: google, microsoft, picker",
-    );
-  });
-});

package/src/utils/login-provider.ts

@@ -1,30 +0,0 @@
-import type { CognitoAuthConfig } from "@indigoai-us/hq-cloud";
-import { DEFAULT_COGNITO } from "./cognito-session.js";
-
-const PROVIDER_TO_COGNITO_IDP = {
-  google: "Google",
-  microsoft: "MicrosoftPersonal",
-  picker: undefined,
-} as const;
-
-export type LoginProvider = keyof typeof PROVIDER_TO_COGNITO_IDP;
-
-export function parseLoginProvider(value: string | undefined): LoginProvider | undefined {
-  if (value === undefined) return undefined;
-  const normalized = value.trim().toLowerCase();
-  if (normalized in PROVIDER_TO_COGNITO_IDP) {
-    return normalized as LoginProvider;
-  }
-  throw new Error("Provider must be one of: google, microsoft, picker");
-}
-
-export function cognitoConfigForLoginProvider(
-  value: string | undefined,
-): CognitoAuthConfig {
-  const provider = parseLoginProvider(value);
-  if (!provider) return DEFAULT_COGNITO;
-  return {
-    ...DEFAULT_COGNITO,
-    identityProvider: PROVIDER_TO_COGNITO_IDP[provider],
-  };
-}