@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/utils/vault-api.ts

@@ -1,382 +0,0 @@
-import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
-import { Sentry } from '../sentry.js';
-import { AuthError } from './auth-error.js';
-import { CompanySelectionError } from './company-selection-error.js';
-import { recordPlanLimitStatus } from '../lib/plan-limit-nag.js';
-
-export interface VaultApiOptions {
-  /**
-   * Control-plane origin. Defaults to DEFAULT_VAULT_API_URL. Set it when a
-   * caller has been pointed at another deployment, so identity and every
-   * other call resolve against the SAME plane — a token minted for one and
-   * sent to another is simply rejected, which reads as an auth failure.
-   */
-  baseUrl?: string;
-  token: string;
-  path: string;
-  method?: string;
-  body?: Record<string, unknown>;
-  query?: Record<string, string>;
-  signal?: AbortSignal;
-}
-
-/**
- * Best-effort peek of a 2xx JSON body for plan-limit status (US-016).
- *
- * For ok JSON responses: read the body ONCE, record planLimits (best-effort),
- * and return a NEW Response built from the buffered body so callers can still
- * call .json()/.text()/.arrayBuffer(). Non-JSON and non-ok responses are
- * returned untouched (streamed binary downloads must never be buffered).
- *
- * Never throws. On any error: return the original response if its body has
- * not been consumed, otherwise the re-wrapped one.
- *
- * Why not response.clone()? Cloning tees the undici body stream; when a
- * caller never consumes the original Response body (many commands only check
- * response.ok/status), the unused tee branch keeps the connection/handle
- * referenced and the process (or vitest worker / spawned CLI child) never
- * exits on Linux CI. Reading once + re-wrapping fully drains the stream.
- */
-async function peekPlanLimitStatus(response: Response): Promise<Response> {
-  try {
-    if (!response.ok) return response;
-    const ct = response.headers.get('content-type') ?? '';
-    if (!ct.includes('application/json') && !ct.includes('+json')) {
-      return response;
-    }
-
-    let buf: ArrayBuffer;
-    try {
-      buf = await response.arrayBuffer();
-    } catch {
-      // Body may be locked/errored; original is the only thing we can return.
-      return response;
-    }
-
-    try {
-      const text = new TextDecoder().decode(buf);
-      try {
-        recordPlanLimitStatus(JSON.parse(text) as unknown);
-      } catch {
-        // Malformed JSON must be ignored silently.
-      }
-    } catch {
-      // Best-effort record only — still re-wrap so body is readable.
-    }
-
-    // Body was consumed; always return a re-wrapped Response so callers can
-    // still read it (even if parse/record failed).
-    return new Response(buf, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: response.headers,
-    });
-  } catch {
-    // Outer safety net: never throw from the peek path. If we never consumed
-    // the body, the original is still usable.
-    return response;
-  }
-}
-
-export async function vaultApiFetch(opts: VaultApiOptions): Promise<Response> {
-  const url = new URL(opts.path, opts.baseUrl ?? DEFAULT_VAULT_API_URL);
-  if (opts.query) {
-    for (const [k, v] of Object.entries(opts.query)) {
-      url.searchParams.set(k, v);
-    }
-  }
-  const method = opts.method ?? 'GET';
-  const safeUrl = url.search ? `${url.origin}${url.pathname}?<redacted>` : `${url.origin}${url.pathname}`;
-  Sentry.addBreadcrumb({
-    category: "http",
-    message: `${method} ${opts.path}`,
-    level: "info",
-    data: { url: safeUrl, method },
-  });
-  const response = await fetch(url.toString(), {
-    method,
-    headers: {
-      Authorization: `Bearer ${opts.token}`,
-      'Content-Type': 'application/json',
-    },
-    body: opts.body ? JSON.stringify(opts.body) : undefined,
-    signal: opts.signal,
-  });
-  if (!response.ok) {
-    Sentry.addBreadcrumb({
-      category: "http",
-      message: `${method} ${opts.path} → ${response.status}`,
-      level: "warning",
-      data: { url: safeUrl, status: response.status },
-    });
-    return response;
-  }
-  return peekPlanLimitStatus(response);
-}
-
-/**
- * Public (NONE-auth) GET against the vault API — no bearer token. The
- * marketplace browse endpoints (`GET /v1/listings`, `GET /v1/listings/{id}`)
- * from US-005 are public so a logged-out user can resolve + download an
- * approved pack. Distinct from `vaultApiFetch`, which always attaches a
- * bearer token.
- */
-export async function vaultApiFetchPublic(opts: {
-  path: string;
-  query?: Record<string, string>;
-}): Promise<Response> {
-  const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
-  if (opts.query) {
-    for (const [k, v] of Object.entries(opts.query)) {
-      url.searchParams.set(k, v);
-    }
-  }
-  const safeUrl = url.search
-    ? `${url.origin}${url.pathname}?<redacted>`
-    : `${url.origin}${url.pathname}`;
-  Sentry.addBreadcrumb({
-    category: 'http',
-    message: `GET ${opts.path}`,
-    level: 'info',
-    data: { url: safeUrl, method: 'GET' },
-  });
-  const response = await fetch(url.toString(), {
-    method: 'GET',
-    headers: { 'Content-Type': 'application/json' },
-  });
-  if (!response.ok) {
-    Sentry.addBreadcrumb({
-      category: 'http',
-      message: `GET ${opts.path} → ${response.status}`,
-      level: 'warning',
-      data: { url: safeUrl, status: response.status },
-    });
-  }
-  return response;
-}
-
-interface MembershipEntry {
-  companyUid: string;
-  role: string;
-  status: string;
-  membershipKey: string;
-}
-
-/**
- * A `--company` value beginning with `cmp_` is a company UID (globally unique
- * by ULID), not a slug. Recognised so the resolver can route it directly by
- * uid — a silent escape hatch, NOT the path users are expected to type.
- * Mirrors hq-cloud's `KNOWN_UID_PREFIXES` / `context.ts` dispatch so the two
- * CLI codebases agree on the uid shape.
- */
-const COMPANY_UID_PREFIX = 'cmp_';
-
-export function looksLikeCompanyUid(ref: string): boolean {
-  return ref.startsWith(COMPANY_UID_PREFIX);
-}
-
-// A 401 from ANY vault resolution call means the caller's HQ session is
-// expired or missing — an expected auth state fixed by `hq login`, not a
-// code defect. Raise a typed AuthError so the top-level handler prints an
-// actionable message and skips Sentry capture (HQ-CLI-8).
-function raiseIfUnauthorized(res: Response): void {
-  if (res.status === 401) throw new AuthError();
-}
-
-async function resolveCompanyByUid(token: string, uid: string): Promise<string> {
-  const res = await vaultApiFetch({
-    token,
-    path: `/entity/${encodeURIComponent(uid)}`,
-  });
-  if (!res.ok) {
-    raiseIfUnauthorized(res);
-    const body = (await res.json().catch(() => ({}))) as { error?: string };
-    throw new Error(
-      `Failed to resolve company '${uid}': ${body.error ?? res.statusText}`,
-    );
-  }
-  const data = (await res.json()) as { entity: { uid: string } };
-  return data.entity.uid;
-}
-
-/**
- * Resolve a company slug WITHIN THE CALLER'S NAMESPACE via the server's
- * caller-scoped `/entity/check-slug/me` endpoint. Returns the caller's own
- * company uid for that slug, or `null` when the caller owns / actively belongs
- * to no company with that slug.
- *
- * This is the load-bearing fix for DEV-1742. Under hq-pro's per-user-namespace
- * model two unrelated tenants may each hold "acme", so the legacy GLOBAL
- * `/entity/by-slug` lookup 409s `SlugNotUniqueError` on a collision and strands
- * the caller — exactly how the liverecover duplicate stayed unreachable. But
- * within ONE caller's world a slug IS unique: hq-pro blocks a second same-slug
- * company from entering a caller's namespace at every seam — create
- * (`findSlugInPersonNamespace` in POST /entity), accept (POST /membership/accept
- * → SlugInUserNamespaceError), and claim (claimByEmail skips the colliding
- * invite). So "the caller's company called <slug>" is unambiguous, and the
- * stranger's same-slug company is correctly invisible to resolution. This is
- * the same primitive hq-cloud's `context.ts` already resolves slugs through.
- */
-async function resolveSlugInCallerNamespace(
-  token: string,
-  slug: string,
-): Promise<string | null> {
-  const res = await vaultApiFetch({
-    token,
-    path: '/entity/check-slug/me',
-    query: { type: 'company', slug },
-  });
-  if (!res.ok) {
-    raiseIfUnauthorized(res);
-    // Namespace lookup unavailable (e.g. membership table not configured →
-    // 503, or the caller has no person entity). A 401 short-circuits above
-    // because the token is bad and the global fallback would only 401 again;
-    // other non-2xx statuses signal "couldn't resolve here" and let the caller
-    // fall back to the global lookup. vaultApiFetch already recorded the
-    // non-2xx as a Sentry breadcrumb, so this is not a silent swallow.
-    return null;
-  }
-  const data = (await res.json()) as {
-    available?: boolean;
-    conflictingCompanyUid?: string;
-  };
-  // `available: false` carries the caller's own company holding the slug.
-  return data.conflictingCompanyUid ?? null;
-}
-
-async function resolveCompanyUid(token: string, ref: string): Promise<string> {
-  // Silent escape hatch: a `cmp_` ref is a uid, not a slug — resolve directly.
-  if (looksLikeCompanyUid(ref)) {
-    return resolveCompanyByUid(token, ref);
-  }
-
-  // PRIMARY PATH — caller-scoped slug resolution. Resolves the slug to the
-  // caller's OWN company (unique within their namespace by the invariant
-  // above), making a stranger's same-slug company invisible.
-  const mine = await resolveSlugInCallerNamespace(token, ref);
-  if (mine) {
-    return mine;
-  }
-
-  // The caller owns / belongs to no company with this slug. Fall back to the
-  // GLOBAL by-slug lookup for the cross-company / admin resolutions that
-  // intentionally target a company the caller isn't a member of (e.g. a
-  // group-grant target). A single global match resolves cleanly.
-  const res = await vaultApiFetch({
-    token,
-    path: `/entity/by-slug/company/${encodeURIComponent(ref)}`,
-  });
-  if (!res.ok) {
-    raiseIfUnauthorized(res);
-    const body = (await res.json().catch(() => ({}))) as {
-      error?: string;
-      uids?: string[];
-    };
-    // Residual true ambiguity: the slug matches multiple live companies and
-    // NONE is in the caller's namespace (server returns 409 SlugNotUniqueError
-    // with the colliding `uids`). The caller-scoped path can't pick one, so
-    // tell them exactly how — re-run with `--company <uid>` — and list the
-    // candidates, instead of echoing the generic server message.
-    if (res.status === 409 && Array.isArray(body.uids) && body.uids.length > 0) {
-      throw new CompanySelectionError(
-        `Company slug '${ref}' matches ${body.uids.length} companies and none ` +
-          `is in your namespace. Re-run with --company <uid> to pick one:\n` +
-          body.uids.map((u) => `  --company ${u}`).join('\n'),
-      );
-    }
-    if (res.status === 404 && body.error === "Entity not found") {
-      throw Object.assign(
-        new Error(
-          `Company slug '${ref}' was not found. Check the slug or run \`hq companies list\`.`,
-        ),
-        { expected: true as const },
-      );
-    }
-    throw new Error(
-      `Failed to resolve company slug '${ref}': ${body.error ?? res.statusText}`,
-    );
-  }
-  const data = (await res.json()) as { entity: { uid: string } };
-  return data.entity.uid;
-}
-
-async function resolveCompanyFromMemberships(token: string): Promise<string> {
-  const res = await vaultApiFetch({
-    token,
-    path: '/membership/me',
-  });
-  if (!res.ok) {
-    throw new Error("Failed to fetch memberships — run `hq login` and try again");
-  }
-  const data = (await res.json()) as { memberships: MembershipEntry[] };
-  const active = data.memberships.filter((m) => m.status === 'active');
-  if (active.length === 0) {
-    throw new CompanySelectionError('No active company memberships found. Use --company <slug> to specify.');
-  }
-  if (active.length === 1) {
-    return active[0].companyUid;
-  }
-  const uids = active.map((m) => m.companyUid);
-  throw new CompanySelectionError(
-    `Multiple active companies found. Re-run with --company <slug-or-uid> to ` +
-      `pick one:\n` +
-      uids.map((u) => `  --company ${u}`).join('\n'),
-  );
-}
-
-export async function getCompanyUid(
-  token: string,
-  companySlug: string | undefined,
-): Promise<string> {
-  if (companySlug) {
-    return resolveCompanyUid(token, companySlug);
-  }
-  return resolveCompanyFromMemberships(token);
-}
-
-interface PersonEntity {
-  uid: string;
-  type: string;
-  createdAt?: string;
-}
-
-// Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
-// createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
-export async function resolveCallerPersonUid(
-  token: string,
-  baseUrl?: string,
-): Promise<string> {
-  const res = await vaultApiFetch({
-    token,
-    path: '/entity/by-type/person',
-    baseUrl,
-  });
-  if (!res.ok) {
-    throw new Error("Failed to fetch person entity — run `hq login` and try again");
-  }
-  const data = (await res.json()) as { entities: PersonEntity[] };
-  const persons = (data.entities ?? []).filter((e) => e.type === 'person');
-  if (persons.length === 0) {
-    throw new Error('No person entity found for the caller. Sign in to HQ once to provision one.');
-  }
-  persons.sort((a, b) => {
-    const ac = a.createdAt ?? '';
-    const bc = b.createdAt ?? '';
-    if (ac !== bc) return ac < bc ? -1 : 1;
-    return a.uid < b.uid ? -1 : 1;
-  });
-  return persons[0].uid;
-}
-
-// Resolves the scope UID (cmp_* or prs_*) for a secrets command. Precedence:
-// `--personal` → caller's canonical person entity; else `--company <slug>` →
-// resolved company UID; else fallback to single active company membership.
-export async function getEntityUid(
-  token: string,
-  opts: { personal?: boolean; companySlug?: string },
-): Promise<string> {
-  if (opts.personal) {
-    return resolveCallerPersonUid(token);
-  }
-  return getCompanyUid(token, opts.companySlug);
-}

package/src/utils/version-check.test.ts

@@ -1,176 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-
-vi.mock("../cli-version.js", () => ({ CLI_VERSION: "5.12.1" }));
-
-const tmpHome = path.join(os.tmpdir(), `hq-cli-version-check-${process.pid}`);
-
-beforeEach(() => {
-  fs.rmSync(tmpHome, { recursive: true, force: true });
-  fs.mkdirSync(tmpHome, { recursive: true });
-  vi.stubEnv("HOME", tmpHome);
-  vi.unstubAllEnvs();
-  vi.stubEnv("HOME", tmpHome);
-});
-
-afterEach(() => {
-  vi.unstubAllEnvs();
-  vi.restoreAllMocks();
-  fs.rmSync(tmpHome, { recursive: true, force: true });
-});
-
-async function loadModule() {
-  vi.resetModules();
-  return await import("./version-check.js");
-}
-
-function writeCache(latest: string, ageMs = 0): void {
-  const cacheDir = path.join(tmpHome, ".hq");
-  fs.mkdirSync(cacheDir, { recursive: true });
-  fs.writeFileSync(
-    path.join(cacheDir, "version-check.json"),
-    JSON.stringify({ latest, fetchedAt: Date.now() - ageMs }),
-  );
-}
-
-describe("maybeWarnNewVersion", () => {
-  it("warns on stderr when cached latest is newer than CLI_VERSION", async () => {
-    writeCache("5.99.0");
-    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
-    const mod = await loadModule();
-    mod.maybeWarnNewVersion();
-    expect(warn).toHaveBeenCalledTimes(1);
-    const msg = warn.mock.calls[0]?.join(" ") ?? "";
-    expect(msg).toContain("5.99.0");
-    expect(msg.toLowerCase()).toContain("update");
-  });
-
-  it("is silent when cached latest equals CLI_VERSION", async () => {
-    writeCache("5.12.1");
-    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
-    const mod = await loadModule();
-    mod.maybeWarnNewVersion();
-    expect(warn).not.toHaveBeenCalled();
-  });
-
-  it("is silent when cached latest is older than CLI_VERSION", async () => {
-    writeCache("5.0.0");
-    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
-    const mod = await loadModule();
-    mod.maybeWarnNewVersion();
-    expect(warn).not.toHaveBeenCalled();
-  });
-
-  it("is silent when there is no cache yet (first run)", async () => {
-    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
-    const mod = await loadModule();
-    mod.maybeWarnNewVersion();
-    expect(warn).not.toHaveBeenCalled();
-  });
-
-  it("ignores cache entries older than the TTL (24h default)", async () => {
-    writeCache("5.99.0", 25 * 60 * 60 * 1000);
-    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
-    const mod = await loadModule();
-    mod.maybeWarnNewVersion();
-    expect(warn).not.toHaveBeenCalled();
-  });
-
-  it("is silent when HQ_NO_UPDATE_CHECK=1 is set, even with newer cached version", async () => {
-    writeCache("5.99.0");
-    vi.stubEnv("HQ_NO_UPDATE_CHECK", "1");
-    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
-    const mod = await loadModule();
-    mod.maybeWarnNewVersion();
-    expect(warn).not.toHaveBeenCalled();
-  });
-
-  it("does not throw on malformed cache JSON", async () => {
-    const cacheDir = path.join(tmpHome, ".hq");
-    fs.mkdirSync(cacheDir, { recursive: true });
-    fs.writeFileSync(path.join(cacheDir, "version-check.json"), "not json{");
-    const warn = vi.spyOn(console, "error").mockImplementation(() => {});
-    const mod = await loadModule();
-    expect(() => mod.maybeWarnNewVersion()).not.toThrow();
-    expect(warn).not.toHaveBeenCalled();
-  });
-});
-
-describe("refreshVersionCache", () => {
-  it("writes the latest version from the npm registry to the cache file", async () => {
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      json: async () => ({ version: "5.99.0" }),
-    } as unknown as Response);
-    vi.stubGlobal("fetch", fetchMock);
-
-    const mod = await loadModule();
-    await mod.refreshVersionCache();
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    const url = fetchMock.mock.calls[0]?.[0] as string;
-    expect(url).toContain("registry.npmjs.org");
-    expect(url).toContain("%40indigoai-us%2Fhq-cli");
-
-    const cachePath = path.join(tmpHome, ".hq", "version-check.json");
-    const written = JSON.parse(fs.readFileSync(cachePath, "utf-8"));
-    expect(written.latest).toBe("5.99.0");
-    expect(typeof written.fetchedAt).toBe("number");
-  });
-
-  it("returns without fetching when the cached version is still within the TTL", async () => {
-    writeCache("5.99.0", 60 * 1000);
-    const fetchMock = vi.fn();
-    vi.stubGlobal("fetch", fetchMock);
-
-    const mod = await loadModule();
-    await mod.refreshVersionCache();
-
-    expect(fetchMock).not.toHaveBeenCalled();
-    const cachePath = path.join(tmpHome, ".hq", "version-check.json");
-    const written = JSON.parse(fs.readFileSync(cachePath, "utf-8"));
-    expect(written.latest).toBe("5.99.0");
-  });
-
-  it("skips passive refresh for noninteractive status probes", async () => {
-    const originalArgv = process.argv;
-    process.argv = ["node", "hq", "mcp", "status", "--json"];
-    const fetchMock = vi.fn();
-    vi.stubGlobal("fetch", fetchMock);
-
-    try {
-      const mod = await loadModule();
-      await mod.refreshVersionCache();
-    } finally {
-      process.argv = originalArgv;
-    }
-
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-
-  it("does not throw or write a cache when fetch fails", async () => {
-    const fetchMock = vi.fn().mockRejectedValue(new Error("network down"));
-    vi.stubGlobal("fetch", fetchMock);
-
-    const mod = await loadModule();
-    await expect(mod.refreshVersionCache()).resolves.toBeUndefined();
-
-    const cachePath = path.join(tmpHome, ".hq", "version-check.json");
-    expect(fs.existsSync(cachePath)).toBe(false);
-  });
-
-  it("does not fetch or write cache when HQ_NO_UPDATE_CHECK=1", async () => {
-    vi.stubEnv("HQ_NO_UPDATE_CHECK", "1");
-    const fetchMock = vi.fn();
-    vi.stubGlobal("fetch", fetchMock);
-
-    const mod = await loadModule();
-    await mod.refreshVersionCache();
-
-    expect(fetchMock).not.toHaveBeenCalled();
-    const cachePath = path.join(tmpHome, ".hq", "version-check.json");
-    expect(fs.existsSync(cachePath)).toBe(false);
-  });
-});