@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/test/commands/db-tenant-isolation.test.ts

@@ -1,94 +0,0 @@
-/**
- * Tenant isolation regression suite (US-011) — CLI + control-plane client side.
- *
- * API matrix lives primarily in hq-pro; this suite asserts CLI path denial and
- * secret-ref namespacing expectations.
- */
-
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-import { ControlPlaneDbClient } from "../../src/lib/db/control-plane.js";
-import { openLocalDb } from "../../src/lib/db/local.js";
-import { resolveLocalDbPath } from "../../src/lib/db/paths.js";
-import { runLocalSql } from "../../src/lib/db/sql.js";
-
-const temps: string[] = [];
-
-afterEach(() => {
-  while (temps.length) {
-    const d = temps.pop();
-    if (d) fs.rmSync(d, { recursive: true, force: true });
-  }
-});
-
-describe("tenant isolation (local + remote client)", () => {
-  it("company A cannot open company B local path by override", () => {
-    const home = fs.mkdtempSync(path.join(os.tmpdir(), "hq-db-iso-"));
-    temps.push(home);
-    openLocalDb("alpha", { home }).close();
-    openLocalDb("beta", { home }).close();
-    const betaPath = resolveLocalDbPath("beta", { home });
-
-    expect(() =>
-      runLocalSql({
-        company: "alpha",
-        home,
-        sql: "SELECT 1",
-        dbPathOverride: betaPath,
-      }),
-    ).toThrow(/denied/i);
-  });
-
-  it("Y cannot provision X via control plane (403)", async () => {
-    const fetchImpl = vi.fn(async () => {
-      return new Response(JSON.stringify({ error: "Forbidden" }), {
-        status: 403,
-      });
-    }) as unknown as typeof fetch;
-
-    const client = new ControlPlaneDbClient({
-      baseUrl: "https://api.example",
-      getAccessToken: async () => "tok-y",
-      fetchImpl,
-    });
-
-    await expect(
-      client.provision({ companyUid: "cmp_x", companySlug: "x" }),
-    ).rejects.toMatchObject({ status: 403 });
-  });
-
-  it("secret refs are company-namespaced", async () => {
-    const fetchImpl = vi.fn(async () => {
-      return new Response(
-        JSON.stringify({
-          ok: true,
-          companyUid: "cmp_x",
-          companySlug: "x",
-          engineId: "aurora-dsql",
-          resourceArn: "arn:aws:dsql:us-east-1:1:cluster/x",
-          region: "us-east-1",
-          status: "ready",
-          secretRef: "ssm:/hq/cmp_x/secrets/DB/REMOTE/X",
-          idempotent: false,
-        }),
-        { status: 200 },
-      );
-    }) as unknown as typeof fetch;
-
-    const client = new ControlPlaneDbClient({
-      baseUrl: "https://api.example",
-      getAccessToken: async () => "tok",
-      fetchImpl,
-    });
-    const result = await client.provision({
-      companyUid: "cmp_x",
-      companySlug: "x",
-    });
-    expect(result.secretRef).toContain("cmp_x");
-    expect(result.secretRef).not.toContain("cmp_y");
-  });
-});

package/test/commands/db.test.ts

@@ -1,85 +0,0 @@
-/**
- * C1 local `hq db` harness (vault-databases US-006).
- *
- * Offline only: temp HOME + temp HQ root, zero network.
- * Covers path resolution, status auto-create, sql select, migrate apply/idempotent.
- */
-
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-import { afterEach, describe, expect, it } from "vitest";
-
-import { ensureAndStatusLocalDb } from "../../src/lib/db/local.js";
-import { migrateLocalDb } from "../../src/lib/db/migrate.js";
-import { resolveLocalDbPath } from "../../src/lib/db/paths.js";
-import { runLocalSql } from "../../src/lib/db/sql.js";
-
-const temps: string[] = [];
-
-function fixture(): { home: string; hqRoot: string } {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-db-harness-"));
-  temps.push(root);
-  const home = path.join(root, "home");
-  const hqRoot = path.join(root, "hq");
-  fs.mkdirSync(home, { recursive: true });
-  fs.mkdirSync(hqRoot, { recursive: true });
-  return { home, hqRoot };
-}
-
-afterEach(() => {
-  while (temps.length > 0) {
-    const d = temps.pop();
-    if (d) fs.rmSync(d, { recursive: true, force: true });
-  }
-});
-
-describe("hq db C1 harness (offline)", () => {
-  it("path resolution for two company slugs under documented root", () => {
-    const { home } = fixture();
-    const a = resolveLocalDbPath("indigo", { home });
-    const b = resolveLocalDbPath("acme", { home });
-    expect(a).toContain(path.join(".hq", "db", "indigo", "vault.db"));
-    expect(b).toContain(path.join(".hq", "db", "acme", "vault.db"));
-    expect(a).not.toBe(b);
-  });
-
-  it("status auto-creates WAL SQLite and reopen is stable", () => {
-    const { home } = fixture();
-    const first = ensureAndStatusLocalDb("fixture", { home });
-    expect(first.healthy).toBe(true);
-    expect(first.journalMode?.toLowerCase()).toBe("wal");
-    expect(fs.existsSync(first.path)).toBe(true);
-
-    const size1 = fs.statSync(first.path).size;
-    const second = ensureAndStatusLocalDb("fixture", { home });
-    expect(second.healthy).toBe(true);
-    expect(fs.statSync(second.path).size).toBeGreaterThanOrEqual(size1);
-  });
-
-  it("sql select after migrate smoke table", () => {
-    const { home, hqRoot } = fixture();
-    const migDir = path.join(hqRoot, "companies", "fixture", "db", "migrations");
-    fs.mkdirSync(migDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(migDir, "001_smoke.sql"),
-      "CREATE TABLE smoke (id INTEGER PRIMARY KEY, v TEXT);\nINSERT INTO smoke (v) VALUES ('ok');\n",
-      "utf8",
-    );
-
-    const mig = migrateLocalDb({ company: "fixture", home, hqRoot });
-    expect(mig.applied).toContain("001_smoke.sql");
-
-    const rows = runLocalSql({
-      company: "fixture",
-      home,
-      sql: "SELECT v FROM smoke",
-    });
-    expect(rows.rows[0]).toMatchObject({ v: "ok" });
-
-    const again = migrateLocalDb({ company: "fixture", home, hqRoot });
-    expect(again.applied).toEqual([]);
-    expect(again.skipped.length).toBeGreaterThan(0);
-  });
-});

package/test/commands/signals.test.ts

@@ -1,207 +0,0 @@
-/**
- * signals.test.ts — E2E tests for `hq signals` (US-007).
- *
- * Drives the full CLI through `runCli` with `globalThis.fetch` stubbed
- * (vault-service) and the hq-cloud signals S3 factory swapped to an
- * in-memory stub. Covers the three e2e cases defined in the PRD:
- *
- *   1. `hq signals list --entity indigo --type action_item --format json`
- *      → exit 0, JSON entry with signalId='xyz'.
- *   2. `hq signals list --entity indigo --type ramble`
- *      → exit 1, stderr lists the six canonical signal types.
- *   3. `hq signals types`
- *      → exit 0, stdout equals "action_item\ncommitment\ndecision\nkey_point\nrisk\nsummary\n".
- *
- * HQ_ACCESS_TOKEN is set per-test so resolveAccessToken() short-circuits
- * away from the interactive Cognito flow.
- */
-
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import {
-  _setSignalsS3Factory,
-  _resetSignalsS3Factory,
-} from "@indigoai-us/hq-cloud";
-import { mockVaultService } from "../helpers/vault-service-mock.js";
-import { runCli } from "../helpers/cli-runner.js";
-
-// ---------------------------------------------------------------------------
-// Fixture — action_item signal matching sources-pipeline output shape
-// ---------------------------------------------------------------------------
-
-const ACTION_ITEM_MD = `---
-signal_id: xyz
-signal_type: action_item
-source_ref: abc-meeting-001
-citations:
-  - "Stefan to review the sources pipeline implementation by end of week"
-entity_refs:
-  - stefan@indigoai.us
-created_at: "2026-03-15T15:00:00Z"
----
-
-Stefan will review the sources pipeline implementation and provide feedback by Friday.
-`;
-
-const BODY_SENTINEL = "Stefan will review the sources pipeline implementation";
-
-// ---------------------------------------------------------------------------
-// Per-test setup — vault + S3 mocks + isolated --hq-root
-// ---------------------------------------------------------------------------
-
-let restoreFetch: (() => void) | undefined;
-let tmpHqRoot: string;
-let savedEnv: { HQ_ACCESS_TOKEN: string | undefined };
-
-beforeEach(async () => {
-  savedEnv = { HQ_ACCESS_TOKEN: process.env.HQ_ACCESS_TOKEN };
-  process.env.HQ_ACCESS_TOKEN = "test-access-token";
-
-  tmpHqRoot = mkdtempSync(join(tmpdir(), "hq-signals-test-"));
-
-  // Transport-switch proof: every read in this suite targets a COMPANY (cmp_)
-  // entity, which routes through presign as of HQ-59. The direct-S3 factory is
-  // wired to THROW so any read accidentally falling back to S3 fails loudly
-  // (mirrors hq-cloud's #88 "S3 stub throws if touched" tests).
-  _setSignalsS3Factory(() => {
-    throw new Error(
-      "S3 transport must not be used for a company (cmp_) read — HQ-59 routes these through presign",
-    );
-  });
-
-  // `files` serves the fixture over the presigned-URL transport (the path
-  // company reads take).
-  restoreFetch = await mockVaultService({
-    entities: [{ uid: "cmp_indigo_001", slug: "indigo", bucketName: "hq-indigo-bucket" }],
-    files: [
-      {
-        key: "signals/action_item/xyz.md",
-        content: ACTION_ITEM_MD,
-        lastModified: new Date("2026-03-15T15:00:00Z"),
-      },
-    ],
-  });
-});
-
-afterEach(() => {
-  _resetSignalsS3Factory();
-  restoreFetch?.();
-  restoreFetch = undefined;
-  rmSync(tmpHqRoot, { recursive: true, force: true });
-
-  if (savedEnv.HQ_ACCESS_TOKEN === undefined) {
-    delete process.env.HQ_ACCESS_TOKEN;
-  } else {
-    process.env.HQ_ACCESS_TOKEN = savedEnv.HQ_ACCESS_TOKEN;
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Tests — PRD e2e cases
-// ---------------------------------------------------------------------------
-
-describe("hq signals (e2e)", () => {
-  it("list --entity indigo --type action_item --format json — exit 0 + signalId='xyz'", async () => {
-    const result = await runCli([
-      "hq",
-      "signals",
-      "list",
-      "--entity",
-      "indigo",
-      "--type",
-      "action_item",
-      "--format",
-      "json",
-      "--hq-root",
-      tmpHqRoot,
-    ]);
-
-    expect(result.exitCode, `stderr=${result.stderr}`).toBe(0);
-    expect(result.stderr).toBe("");
-
-    const parsed = JSON.parse(result.stdout) as {
-      entries: Array<{ signalId: string; signalType: string; key: string }>;
-      nextToken?: string;
-    };
-    expect(parsed.entries).toHaveLength(1);
-    expect(parsed.entries[0].signalId).toBe("xyz");
-    expect(parsed.entries[0].signalType).toBe("action_item");
-    expect(parsed.entries[0].key).toBe("signals/action_item/xyz.md");
-  });
-
-  it("list --entity indigo --type ramble — exit 1 + stderr lists six canonical types", async () => {
-    const result = await runCli([
-      "hq",
-      "signals",
-      "list",
-      "--entity",
-      "indigo",
-      "--type",
-      "ramble",
-      "--format",
-      "json",
-      "--hq-root",
-      tmpHqRoot,
-    ]);
-
-    expect(result.exitCode).toBe(1);
-    // Every canonical signal type must appear in the error message.
-    for (const t of [
-      "action_item",
-      "commitment",
-      "decision",
-      "key_point",
-      "risk",
-      "summary",
-    ]) {
-      expect(result.stderr).toContain(t);
-    }
-  });
-
-  it("types — exit 0 + stdout equals the sorted six types, one per line", async () => {
-    const result = await runCli(["hq", "signals", "types"]);
-    expect(result.exitCode).toBe(0);
-    // Sorted alphabetically — happens to match SIGNAL_TYPES insertion order.
-    expect(result.stdout).toBe(
-      "action_item\ncommitment\ndecision\nkey_point\nrisk\nsummary\n",
-    );
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Bonus coverage — get + wiring
-// ---------------------------------------------------------------------------
-
-describe("hq signals get", () => {
-  it("get --entity indigo --type action_item --id xyz --format markdown — body present", async () => {
-    const result = await runCli([
-      "hq",
-      "signals",
-      "get",
-      "--entity",
-      "indigo",
-      "--type",
-      "action_item",
-      "--id",
-      "xyz",
-      "--format",
-      "markdown",
-      "--hq-root",
-      tmpHqRoot,
-    ]);
-
-    expect(result.exitCode, `stderr=${result.stderr}`).toBe(0);
-    expect(result.stderr).toBe("");
-    expect(result.stdout).toContain(BODY_SENTINEL);
-  });
-});
-
-describe("hq --help wiring", () => {
-  it("mentions the signals subcommand", async () => {
-    const result = await runCli(["hq", "--help"]);
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout).toContain("signals");
-  });
-});

package/test/commands/sources.test.ts

@@ -1,231 +0,0 @@
-/**
- * sources.test.ts — E2E tests for `hq sources` (US-006).
- *
- * Drives the full CLI through `runCli` with `globalThis.fetch` stubbed
- * (vault-service) and the hq-cloud sources S3 factory swapped to an
- * in-memory stub. Tests the four e2e cases defined in the PRD:
- *
- *   1. `hq sources list --entity indigo --type meeting --format json`
- *      → exit 0, JSON entry with sourceId='abc'.
- *   2. `hq sources get --entity indigo --type meeting --id abc`
- *      → exit 0, body text present in stdout.
- *   3. `hq sources list --type meeting` (no --entity, no config)
- *      → exit 1, stderr mentions --entity.
- *   4. `hq sources list --entity indigo --type pigeon`
- *      → exit 1, stderr lists valid channels.
- *
- * HQ_ACCESS_TOKEN is set per-test so resolveAccessToken() short-circuits
- * away from the interactive Cognito flow.
- */
-
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import {
-  _setSourcesS3Factory,
-  _resetSourcesS3Factory,
-} from "@indigoai-us/hq-cloud";
-import { mockVaultService } from "../helpers/vault-service-mock.js";
-import { runCli } from "../helpers/cli-runner.js";
-
-// ---------------------------------------------------------------------------
-// Fixtures
-// ---------------------------------------------------------------------------
-
-/**
- * Markdown source matching sources-pipeline output shape.
- * NOTE: stored at `sources/meetings/abc.md` (plural `meetings/`) — the
- * sources-pipeline writes "meeting" channel content to `sources/meetings/`
- * (only special-cased channel; others pass through). hq-cloud's
- * sourcePathSegment() mirrors this canonical mapping.
- */
-const MEETING_MD = `---
-source_id: abc
-source_type: meeting
-channel: meeting
-title: Q1 Planning Meeting
----
-
-[Stefan 00:00:05]: Body text goes here for the e2e test.
-[Corey 00:00:12]: Acknowledged.
-`;
-
-// Sentinel string used to assert body presence in `hq sources get` output.
-const BODY_SENTINEL = "Body text goes here for the e2e test.";
-
-// ---------------------------------------------------------------------------
-// Per-test setup — vault + S3 mocks + isolated --hq-root
-// ---------------------------------------------------------------------------
-
-let restoreFetch: (() => void) | undefined;
-let tmpHqRoot: string;
-let savedEnv: { HQ_ACCESS_TOKEN: string | undefined };
-
-beforeEach(async () => {
-  // Sidestep Cognito interactive flow.
-  savedEnv = { HQ_ACCESS_TOKEN: process.env.HQ_ACCESS_TOKEN };
-  process.env.HQ_ACCESS_TOKEN = "test-access-token";
-
-  // Empty .hq tree so `readActiveCompanySlug` returns undefined unless a
-  // test writes config.json into it.
-  tmpHqRoot = mkdtempSync(join(tmpdir(), "hq-sources-test-"));
-
-  // Transport-switch proof: every read in this suite targets a COMPANY (cmp_)
-  // entity, which routes through presign as of HQ-59. The direct-S3 factory is
-  // wired to THROW so that any read accidentally falling back to S3 fails the
-  // test loudly (mirrors hq-cloud's #88 "S3 stub throws if touched" tests).
-  _setSourcesS3Factory(() => {
-    throw new Error(
-      "S3 transport must not be used for a company (cmp_) read — HQ-59 routes these through presign",
-    );
-  });
-
-  // Default vault-service mock with one entity 'indigo'. `files` serves the
-  // fixture over the presigned-URL transport (the path company reads take).
-  restoreFetch = await mockVaultService({
-    entities: [{ uid: "cmp_indigo_001", slug: "indigo", bucketName: "hq-indigo-bucket" }],
-    files: [
-      {
-        key: "sources/meetings/abc.md",
-        content: MEETING_MD,
-        lastModified: new Date("2026-03-15T14:00:00Z"),
-      },
-    ],
-  });
-});
-
-afterEach(() => {
-  _resetSourcesS3Factory();
-  restoreFetch?.();
-  restoreFetch = undefined;
-  rmSync(tmpHqRoot, { recursive: true, force: true });
-
-  if (savedEnv.HQ_ACCESS_TOKEN === undefined) {
-    delete process.env.HQ_ACCESS_TOKEN;
-  } else {
-    process.env.HQ_ACCESS_TOKEN = savedEnv.HQ_ACCESS_TOKEN;
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Tests — PRD e2e cases
-// ---------------------------------------------------------------------------
-
-describe("hq sources (e2e)", () => {
-  it("list --entity indigo --type meeting --format json — exit 0 + JSON with sourceId='abc'", async () => {
-    const result = await runCli([
-      "hq",
-      "sources",
-      "list",
-      "--entity",
-      "indigo",
-      "--type",
-      "meeting",
-      "--format",
-      "json",
-      "--hq-root",
-      tmpHqRoot,
-    ]);
-
-    expect(result.exitCode, `stderr=${result.stderr}`).toBe(0);
-    expect(result.stderr).toBe("");
-
-    const parsed = JSON.parse(result.stdout) as {
-      entries: Array<{ sourceId: string; channel: string; key: string }>;
-      nextToken?: string;
-    };
-    expect(parsed.entries).toHaveLength(1);
-    expect(parsed.entries[0].sourceId).toBe("abc");
-    expect(parsed.entries[0].channel).toBe("meeting");
-    expect(parsed.entries[0].key).toBe("sources/meetings/abc.md");
-  });
-
-  it("get --entity indigo --type meeting --id abc — exit 0 + stdout contains body text", async () => {
-    const result = await runCli([
-      "hq",
-      "sources",
-      "get",
-      "--entity",
-      "indigo",
-      "--type",
-      "meeting",
-      "--id",
-      "abc",
-      "--format",
-      "markdown",
-      "--hq-root",
-      tmpHqRoot,
-    ]);
-
-    expect(result.exitCode).toBe(0);
-    expect(result.stderr).toBe("");
-    expect(result.stdout).toContain(BODY_SENTINEL);
-  });
-
-  it("list --type meeting (no --entity, no config) — exit 1 + stderr mentions --entity", async () => {
-    // tmpHqRoot has no .hq/config.json, so readActiveCompanySlug returns undefined.
-    const result = await runCli([
-      "hq",
-      "sources",
-      "list",
-      "--type",
-      "meeting",
-      "--format",
-      "json",
-      "--hq-root",
-      tmpHqRoot,
-    ]);
-
-    expect(result.exitCode).toBe(1);
-    expect(result.stderr).toMatch(/--entity/);
-    // Also surfaces the discovery affordance.
-    expect(result.stderr).toMatch(/hq sources entities/);
-  });
-
-  it("list --entity indigo --type pigeon — exit 1 + stderr lists valid channels", async () => {
-    const result = await runCli([
-      "hq",
-      "sources",
-      "list",
-      "--entity",
-      "indigo",
-      "--type",
-      "pigeon",
-      "--format",
-      "json",
-      "--hq-root",
-      tmpHqRoot,
-    ]);
-
-    expect(result.exitCode).toBe(1);
-    // Every canonical channel must appear in the error message.
-    expect(result.stderr).toContain("meeting");
-    expect(result.stderr).toContain("email");
-    expect(result.stderr).toContain("slack");
-    expect(result.stderr).toContain("linear");
-    expect(result.stderr).toContain("notion");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Bonus coverage — channels + wiring
-// ---------------------------------------------------------------------------
-
-describe("hq sources channels", () => {
-  it("prints SOURCE_CHANNELS sorted, one per line, exit 0", async () => {
-    const result = await runCli(["hq", "sources", "channels"]);
-    expect(result.exitCode).toBe(0);
-    const lines = result.stdout.trim().split("\n");
-    // Sorted alphabetically: email, linear, meeting, notion, slack
-    expect(lines).toEqual(["email", "linear", "meeting", "notion", "slack"]);
-  });
-});
-
-describe("hq --help wiring", () => {
-  it("mentions the sources subcommand", async () => {
-    const result = await runCli(["hq", "--help"]);
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout).toContain("sources");
-  });
-});