@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/test/e2e/smoke-install-mcp.sh

@@ -1,113 +0,0 @@
-#!/usr/bin/env bash
-# ---------------------------------------------------------------------------
-# smoke-install-mcp.sh — TRUE end-to-end smoke test of `hq install` for
-# MCP-bearing packs, in a fully isolated sandbox.
-#
-# Unlike the vitest suite (which unit-tests mcp-registration.ts against an
-# injected $HOME), this drives the REAL built `hq` CLI through a REAL
-# `hq install` against REAL packs, so it catches WIRING gaps unit tests miss —
-# e.g. "registerMcpServers is implemented + tested but installPack never calls
-# it" (the exact bug this harness first caught).
-#
-# It NEVER touches the developer's real ~/.claude.json, ~/.mcp.json, or
-# ~/.codex/config.toml — everything lives under a mktemp sandbox HOME, and the
-# install targets a sandbox HQ root.
-#
-# Two packs, two paths:
-#   A) hq-pack-smoke-mcp  (no-secret fixture) → MUST register into both configs
-#   B) vyg-shopify-hq-pack (needs ${secret:VYG_API_KEY}) → MUST defer gracefully
-#      (install succeeds, server NOT registered, "connect first" warning shown)
-#
-# Usage:   bash test/e2e/smoke-install-mcp.sh [--keep]
-# Exit 0 = all checks pass.   Exit 1 = at least one failed.
-# ---------------------------------------------------------------------------
-set -uo pipefail
-
-CLI_REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-HQ_ROOT_REAL="$(cd "$CLI_REPO/../../.." && pwd)"             # …/HQ
-CLI="$CLI_REPO/dist/index.js"
-FIXTURE="$CLI_REPO/test/fixtures/hq-pack-smoke-mcp"          # no-secret pack
-VYG="$HQ_ROOT_REAL/repos/private/vyg-shopify-hq-pack"        # secret-bearing pack
-KEEP=0; [ "${1:-}" = "--keep" ] && KEEP=1
-
-pass=0; fail=0
-ok()  { echo "  ✓ $1"; pass=$((pass+1)); }
-bad() { echo "  ✗ $1"; fail=$((fail+1)); }
-
-[ -f "$CLI" ]     || { echo "FATAL: build first (npm run build) — missing $CLI"; exit 2; }
-[ -d "$FIXTURE" ] || { echo "FATAL: fixture pack missing at $FIXTURE"; exit 2; }
-command -v node >/dev/null || { echo "FATAL: node not on PATH"; exit 2; }
-
-SBX="$(mktemp -d -t hq-smoke-mcp.XXXXXX)"
-SBX_HOME="$SBX/home"; SBX_HQ="$SBX/hq"
-cleanup() { [ "$KEEP" = 1 ] && { echo "sandbox kept: $SBX"; return; }; rm -rf "$SBX"; }
-trap cleanup EXIT
-
-mkdir -p "$SBX_HOME/.codex" "$SBX_HQ/core/packages" "$SBX_HQ/core/workers/public" \
-         "$SBX_HQ/core/knowledge/public/hq-core" "$SBX_HQ/core/policies" \
-         "$SBX_HQ/core/hooks" "$SBX_HQ/.claude/skills" "$SBX_HQ/.claude/commands" \
-         "$SBX_HQ/companies"
-cp -R "$HQ_ROOT_REAL/core/scripts" "$SBX_HQ/core/scripts"
-# Pin the sandbox host version at the M1 floor (>=15.1.0). Copying the live
-# core.yaml is unreliable — hq-sync can reset it below the floor (e.g. 15.0.24),
-# which makes the floor check CORRECTLY refuse the test packs (they require
-# >=15.1.0). This harness exercises the install path; floor-refusal has its own
-# unit test. Pin a satisfying version so the install path is what's under test.
-printf 'hqVersion: "15.1.0"\n' > "$SBX_HQ/core/core.yaml"
-cp "$HQ_ROOT_REAL/core/knowledge/public/hq-core/mcp-manifest.schema.json" \
-   "$SBX_HQ/core/knowledge/public/hq-core/mcp-manifest.schema.json"
-printf 'companies: {}\n' > "$SBX_HQ/companies/manifest.yaml"
-
-# pre-existing non-HQ servers that MUST survive every install/uninstall
-echo '{ "mcpServers": { "figma": { "type": "http", "url": "https://figma.example.test/mcp" } } }' > "$SBX_HOME/.claude.json"
-printf '# user existing codex config\n[mcp_servers.node_repl]\ncommand = "node"\nargs = ["--repl"]\n' > "$SBX_HOME/.codex/config.toml"
-
-# Always run from inside the sandbox HQ root. The CLI resolves the HQ root by
-# walking up from cwd (utils/manifest.js findHqRoot), NOT from $HQ_ROOT — so the
-# cwd is what actually scopes install/uninstall. (We still export HQ_ROOT for the
-# code paths that DO honor it, e.g. scan-packages.) Without the cd, `packs
-# uninstall` resolves the developer's real HQ root and silently no-ops.
-run_hq() { ( cd "$SBX_HQ" && HOME="$SBX_HOME" HQ_ROOT="$SBX_HQ" node "$CLI" "$@" ); }
-claude_has() { node -e "try{const j=require('$SBX_HOME/.claude.json');process.stdout.write(j.mcpServers&&j.mcpServers['$1']?'1':'0')}catch(e){process.stdout.write('0')}"; }
-codex_has()  { c=$(grep -c "\[mcp_servers.$1\]" "$SBX_HOME/.codex/config.toml" 2>/dev/null); echo "${c:-0}"; }
-
-echo "=== HQ MCP install smoke test ==="
-echo "sandbox: $SBX"; echo
-
-# ---- A) NO-SECRET FIXTURE → must register ---------------------------------
-echo "[A] install no-secret fixture (hq-pack-smoke-mcp) — must REGISTER"
-OUT="$(cd "$SBX_HQ" && run_hq install "$FIXTURE" --allow-mcp --allow-hooks 2>&1)"; rc=$?
-echo "$OUT" | sed 's/^/      /'
-[ $rc -eq 0 ] && ok "install exited 0" || bad "install exited $rc"
-[ "$(claude_has smoke-http)" = "1" ] && ok "smoke-http registered in ~/.claude.json" || bad "smoke-http MISSING from ~/.claude.json"
-[ "$(codex_has smoke-http)" -ge 1 ] && ok "smoke-http registered in ~/.codex/config.toml" || bad "smoke-http MISSING from ~/.codex/config.toml"
-[ "$(claude_has figma)" = "1" ]     && ok "figma preserved" || bad "figma LOST"
-[ "$(codex_has node_repl)" -ge 1 ]  && ok "node_repl table preserved" || bad "node_repl LOST"
-if grep -rqiE 'X-Smoke.*static-not-a-secret' "$SBX_HOME/.claude.json"; then ok "static header written (http client usable)"; else bad "static header missing from registered server"; fi
-
-echo "[A.2] hq mcp status --json reports it"
-ST="$(run_hq mcp status --json 2>&1)"
-echo "$ST" | grep -q 'smoke-http' && ok "mcp status reports smoke-http" || bad "mcp status missing smoke-http"
-
-echo "[A.3] uninstall round-trip"
-run_hq packs uninstall hq-pack-smoke-mcp --yes >/dev/null 2>&1 || run_hq packs uninstall hq-pack-smoke-mcp >/dev/null 2>&1
-[ "$(claude_has smoke-http)" = "0" ] && ok "smoke-http removed on uninstall" || bad "smoke-http still present after uninstall"
-[ "$(claude_has figma)" = "1" ]     && ok "figma still preserved after uninstall" || bad "figma lost during uninstall"
-
-# ---- B) VYG PACK (needs a vault secret) → must DEFER gracefully -----------
-echo
-echo "[B] install vyg pack (needs \${secret:VYG_API_KEY}, not in vault) — must DEFER gracefully"
-if [ -d "$VYG" ]; then
-  OUT="$(cd "$SBX_HQ" && run_hq install "$VYG" --allow-mcp --allow-hooks 2>&1)"; rc=$?
-  echo "$OUT" | sed 's/^/      /'
-  [ $rc -eq 0 ] && ok "install exited 0 (did not abort on the missing secret)" || bad "install aborted (rc=$rc) on missing secret"
-  [ "$(claude_has vyg-shopify)" = "0" ] && ok "vyg-shopify correctly DEFERRED (not registered without its key)" || bad "vyg-shopify registered despite missing secret"
-  echo "$OUT" | grep -qiE "VYG_API_KEY|connect-shopify|needs secret" && ok "clear 'provision the key' guidance shown" || bad "no deferral guidance shown to the user"
-  [ "$(claude_has figma)" = "1" ] && ok "figma still preserved through the deferred install" || bad "figma LOST during deferred install"
-else
-  echo "  · vyg pack not present — skipping deferral checks"
-fi
-
-echo
-echo "=== RESULT: $pass passed · $fail failed ==="
-[ $fail -eq 0 ] && exit 0 || exit 1

package/test/fixtures/hq-pack-smoke-mcp/mcp/smoke-http.json

@@ -1 +0,0 @@
-{ "type": "http", "url": "https://smoke.example.test/mcp", "headers": { "X-Smoke": "static-not-a-secret" } }

package/test/fixtures/hq-pack-smoke-mcp/package.yaml

@@ -1,11 +0,0 @@
-name: hq-pack-smoke-mcp
-version: 0.0.1
-publisher: '@indigoai-us'
-access: public
-description: 'No-secret MCP pack — e2e smoke fixture for install registration.'
-requires:
-  hqCore: '>=15.1.0'
-capabilities: [network]
-contributes:
-  mcp:
-    - smoke-http

package/test/fixtures/signals/action_item/sample.md

@@ -1,16 +0,0 @@
----
-signal_id: sig_action_001
-signal_type: action_item
-source_ref: abc-meeting-001
-citations:
-  - "Stefan to review the sources pipeline implementation by end of week"
-  - "Corey to prepare roadmap slides for the next planning session"
-entity_refs:
-  - stefan@indigoai.us
-  - corey@indigoai.us
-created_at: "2026-03-15T15:00:00Z"
----
-
-Stefan will review the sources pipeline implementation and provide feedback by Friday 2026-03-20.
-
-Corey will prepare updated roadmap slides covering the CLI read surface and signal type validation for the follow-up planning session.

package/test/fixtures/signals/summary/sample.md

@@ -1,12 +0,0 @@
----
-signal_id: sig_summary_001
-signal_type: summary
-source_ref: abc-meeting-001
-citations: []
-entity_refs:
-  - stefan@indigoai.us
-  - corey@indigoai.us
-created_at: "2026-03-15T15:00:00Z"
----
-
-The Q1 planning meeting covered roadmap priorities for the sources pipeline and CLI tooling. Key decisions included implementing the `hq sources` and `hq signals` commands in hq-cli, enforcing a closed signal-type enum to prevent agents from inventing new types, and using STS-scoped credentials via vault-service for tenant isolation. The team agreed to ship a read-only CLI surface first before tackling S3 Vectors search in Phase 2.

package/test/fixtures/sources/meetings/sample.md

@@ -1,25 +0,0 @@
----
-source_id: abc-meeting-001
-source_type: meeting
-channel: meeting
-title: Q1 Planning Meeting
-date: "2026-03-15"
-participants:
-  - name: Stefan Johnson
-    email: stefan@indigoai.us
-  - name: Corey Smith
-    email: corey@indigoai.us
-duration_seconds: 3600
-entity_ref: cmp_indigo_001
-created_at: "2026-03-15T14:00:00Z"
----
-
-[Stefan Johnson 00:00:05]: Good morning everyone. Let's get started with the Q1 planning session.
-
-[Corey Smith 00:00:12]: Morning! I have the roadmap slides ready to share.
-
-[Stefan Johnson 00:00:18]: Perfect. First item on the agenda is the sources pipeline work. We need to add a read surface to the CLI so agents and users can browse sources and signals without writing AWS code.
-
-[Corey Smith 00:00:35]: Makes sense. The S3 layout is already defined by the pipeline — sources/{channel}/{sourceId}.md. We just need the listing and fetch commands.
-
-[Stefan Johnson 00:00:48]: Exactly. And we should enforce signal type validation at the CLI layer too. No invented signal types from agents.

package/test/helpers/cli-runner.ts

@@ -1,150 +0,0 @@
-/**
- * cli-runner.ts — in-process Commander test harness.
- *
- * Builds a minimal Commander program and runs it with the given argv,
- * capturing stdout/stderr without forking a child process.
- *
- * The program starts with only the core hq metadata (name, description,
- * version). As new top-level command registrars are added to the CLI
- * (US-006: sources, US-007: signals, etc.), import and register them here
- * so tests that need the full command tree can use the same runner.
- *
- * NOTE: Some existing commands (pkg-install, pack-install) use semver deep
- * subpath imports (semver/functions/satisfies.js) that are not resolvable in
- * the pnpm test context. Those commands are excluded from the test program;
- * add them here only if/when the semver resolution is fixed in devDeps.
- *
- * Usage:
- *   const { exitCode, stdout, stderr } = await runCli(['hq', '--help']);
- */
-
-import { Command } from "commander";
-import { registerLoginCommand } from "../../src/commands/login.js";
-import { registerLogoutCommand } from "../../src/commands/logout.js";
-import { registerWhoamiCommand } from "../../src/commands/whoami.js";
-import { registerSecretsCommand } from "../../src/commands/secrets.js";
-import { registerGroupsCommand } from "../../src/commands/groups.js";
-import { registerSourcesCommand } from "../../src/commands/sources.js";
-import { registerSignalsCommand } from "../../src/commands/signals.js";
-
-export interface CliRunResult {
-  exitCode: number;
-  stdout: string;
-  stderr: string;
-}
-
-/**
- * Builds a test-only Commander program using exitOverride() so Commander
- * throws CommanderError instead of calling process.exit().
- */
-function buildProgram(): Command {
-  const program = new Command();
-
-  program
-    .name("hq")
-    .description("HQ management CLI — modules, packages, and cloud sync")
-    .version("0.0.0-test")
-    .exitOverride();
-
-  // Auth commands (no semver deep imports)
-  registerLoginCommand(program);
-  registerLogoutCommand(program);
-  registerWhoamiCommand(program);
-
-  // Secrets / groups (no semver deep imports)
-  registerSecretsCommand(program);
-  registerGroupsCommand(program);
-
-  // Sources read surface (US-006)
-  registerSourcesCommand(program);
-
-  // Signals read surface (US-007)
-  registerSignalsCommand(program);
-
-  return program;
-}
-
-/**
- * Runs the hq CLI in-process with the given argv.
- *
- * stdout/stderr are intercepted for the duration of the call and restored
- * afterward. Not safe to call concurrently (share process streams).
- */
-export async function runCli(argv: string[]): Promise<CliRunResult> {
-  const stdoutChunks: string[] = [];
-  const stderrChunks: string[] = [];
-  let exitCode = 0;
-
-  const origStdoutWrite = process.stdout.write.bind(process.stdout);
-  const origStderrWrite = process.stderr.write.bind(process.stderr);
-  const origExit = process.exit.bind(process);
-
-  const captureWrite =
-    (chunks: string[]) =>
-    (
-      chunk: string | Uint8Array,
-      encodingOrCb?: unknown,
-      cb?: unknown,
-    ): boolean => {
-      chunks.push(typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf-8"));
-      if (typeof encodingOrCb === "function") (encodingOrCb as () => void)();
-      else if (typeof cb === "function") (cb as () => void)();
-      return true;
-    };
-
-  (process.stdout as { write: unknown }).write = captureWrite(stdoutChunks);
-  (process.stderr as { write: unknown }).write = captureWrite(stderrChunks);
-
-  // Stub process.exit so action-handler exit(code) becomes a thrown error
-  // caught by parseAsync(). Otherwise it would tear down the vitest worker.
-  class ProcessExitError extends Error {
-    code: number;
-    constructor(code: number) {
-      super(`process.exit(${code})`);
-      this.name = "ProcessExitError";
-      this.code = code;
-    }
-  }
-  (process as { exit: unknown }).exit = ((code?: number) => {
-    throw new ProcessExitError(code ?? 0);
-  }) as typeof process.exit;
-
-  try {
-    const program = buildProgram();
-    // Commander's default strips 2 elements (node + script).
-    // Our argv convention is ['hq', ...userArgs], so strip the program name
-    // and use { from: 'user' } so Commander treats the rest as user args.
-    const userArgs = argv[0] === "hq" ? argv.slice(1) : argv;
-    await program.parseAsync(userArgs, { from: "user" });
-    exitCode = 0;
-  } catch (err: unknown) {
-    if (err instanceof ProcessExitError) {
-      // hq command threw via stubbed process.exit (withErrorHandling pattern).
-      // stderr was already written by the action handler.
-      exitCode = err.code;
-    } else if (err && typeof err === "object" && "code" in err) {
-      // Commander error from exitOverride()
-      const ce = err as { code: string; exitCode?: number };
-      if (ce.code === "commander.helpDisplayed" || ce.code === "commander.version") {
-        exitCode = 0;
-      } else {
-        exitCode = ce.exitCode ?? 1;
-      }
-    } else if (err instanceof Error) {
-      stderrChunks.push(err.message + "\n");
-      exitCode = 1;
-    } else {
-      exitCode = 1;
-    }
-  } finally {
-    process.stdout.write = origStdoutWrite;
-    process.stderr.write = origStderrWrite;
-    (process as { exit: unknown }).exit = origExit;
-  }
-
-  return {
-    exitCode,
-    stdout: stdoutChunks.join(""),
-    stderr: stderrChunks.join(""),
-  };
-}

package/test/helpers/s3-list-mock.ts

@@ -1,79 +0,0 @@
-/**
- * s3-list-mock.ts — in-memory stub for @aws-sdk/client-s3 S3Client.
- *
- * Used by sources/signals tests that need ListObjectsV2 and GetObject behaviour
- * without real AWS credentials or network I/O.
- */
-
-import type { S3Client } from "@aws-sdk/client-s3";
-// NOTE: We intentionally do NOT use `instanceof ListObjectsV2Command` for
-// dispatch. When this stub is consumed by code in a sibling package
-// (@indigoai-us/hq-cloud's compiled dist), that code's @aws-sdk/client-s3
-// resolution can produce a distinct constructor instance from the one we
-// import here, breaking instanceof. Dispatching on `command.constructor.name`
-// is identity-free and works across package boundaries.
-
-export interface MockEntry {
-  /** S3 object key (e.g. "sources/meetings/abc.md") */
-  key: string;
-  /** Full file content as UTF-8 string */
-  content: string;
-  /** Optional override; defaults to 2026-01-01T00:00:00Z */
-  lastModified?: Date;
-}
-
-export interface MockS3Options {
-  entries: MockEntry[];
-}
-
-/**
- * Returns a stub S3Client whose `send` method handles:
- *   - ListObjectsV2Command — filters entries by Prefix, no pagination
- *   - GetObjectCommand     — returns a streaming Body for the matching entry
- *
- * Throws `NoSuchKey` (matching AWS SDK error shape) for GetObject misses.
- */
-export function mockS3WithEntries(opts: MockS3Options): S3Client {
-  const { entries } = opts;
-  const defaultDate = new Date("2026-01-01T00:00:00Z");
-
-  async function send(command: unknown): Promise<unknown> {
-    const cmdName = (command as { constructor?: { name?: string } }).constructor?.name ?? "";
-
-    if (cmdName === "ListObjectsV2Command") {
-      const { Prefix } = (command as { input: { Bucket: string; Prefix?: string } }).input;
-      const prefix = Prefix ?? "";
-      const filtered = entries.filter((e) => e.key.startsWith(prefix));
-      return {
-        Contents: filtered.map((e) => ({
-          Key: e.key,
-          Size: Buffer.byteLength(e.content, "utf-8"),
-          LastModified: e.lastModified ?? defaultDate,
-          ETag: `"mock-etag"`,
-        })),
-        IsTruncated: false,
-        NextContinuationToken: undefined,
-        $metadata: {},
-      };
-    }
-
-    if (cmdName === "GetObjectCommand") {
-      const { Key } = (command as { input: { Bucket: string; Key: string } }).input;
-      const entry = entries.find((e) => e.key === Key);
-      if (!entry) {
-        const err = new Error(`The specified key does not exist: ${Key}`);
-        (err as NodeJS.ErrnoException).name = "NoSuchKey";
-        throw err;
-      }
-      const content = entry.content;
-      async function* bodyStream(): AsyncIterable<Uint8Array> {
-        yield Buffer.from(content, "utf-8");
-      }
-      return { Body: bodyStream(), $metadata: {} };
-    }
-
-    throw new Error(`mockS3WithEntries: unhandled command type "${cmdName || "unknown"}"`);
-  }
-
-  return { send } as unknown as S3Client;
-}