@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/scripts/generate-scan-packages-table.mjs

@@ -1,113 +0,0 @@
-#!/usr/bin/env node
-/**
- * generate-scan-packages-table.mjs (US-003)
- *
- * Emits the bash data block that `core/scripts/scan-packages.sh` reads, from the
- * single-source `src/utils/contribution-table.ts`. This keeps the bash wirer
- * GENERATED FROM the table rather than restating the mapping -- the US-003
- * single-source-of-truth invariant.
- *
- * The TS table is the authority; this script transcribes it to bash. It does
- * NOT parse TypeScript -- it imports the same literal data by re-declaring the
- * rows is avoided by reading the table via a tiny regex extraction of the
- * `CONTRIBUTION_TABLE` object literal, so the table file stays the only place
- * the rows live.
- *
- * Output: a bash snippet (to stdout, or written in place into scan-packages.sh
- * between the BEGIN/END GENERATED markers when --write <path> is passed).
- *
- * Usage:
- *   node scripts/generate-scan-packages-table.mjs                 # print block
- *   node scripts/generate-scan-packages-table.mjs --check <path>  # verify in-sync
- *   node scripts/generate-scan-packages-table.mjs --write <path>  # rewrite in place
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const TABLE_TS = path.resolve(__dirname, '../src/utils/contribution-table.ts');
-
-const BEGIN = '# >>> BEGIN GENERATED contribution table (US-003) — do not edit by hand';
-const END = '# <<< END GENERATED contribution table';
-
-/**
- * Extract the rows from the `CONTRIBUTION_TABLE` object literal in the TS file.
- * Each row line looks like:
- *   key: { payload: 'p/{item}', host: 'h', wire: 'symlink' },
- */
-function readTable() {
-  const ts = fs.readFileSync(TABLE_TS, 'utf-8');
-  const open = ts.indexOf('export const CONTRIBUTION_TABLE');
-  if (open < 0) throw new Error('CONTRIBUTION_TABLE not found in ' + TABLE_TS);
-  const body = ts.slice(open, ts.indexOf('} as const', open));
-  const rowRe =
-    /^\s*([A-Za-z_][A-Za-z0-9_]*):\s*\{\s*payload:\s*'([^']+)'\s*,\s*host:\s*'([^']+)'\s*,\s*wire:\s*'([^']+)'\s*\}/gm;
-  const rows = [];
-  let m;
-  while ((m = rowRe.exec(body)) !== null) {
-    rows.push({ key: m[1], payload: m[2], host: m[3], wire: m[4] });
-  }
-  if (rows.length === 0) throw new Error('No rows parsed from CONTRIBUTION_TABLE');
-  return rows;
-}
-
-function renderBlock(rows) {
-  const lines = [];
-  lines.push(BEGIN);
-  lines.push('# Generated from hq-cli/src/utils/contribution-table.ts by');
-  lines.push('# hq-cli/scripts/generate-scan-packages-table.mjs. Regenerate with:');
-  lines.push('#   node scripts/generate-scan-packages-table.mjs --write core/scripts/scan-packages.sh');
-  lines.push('# Each row is "payload|host|wire" (payload uses {item} for the name).');
-  lines.push('# bash 3.2-compatible (macOS default bash has no associative arrays):');
-  lines.push('# a plain indexed key list + a generated case-lookup function.');
-  lines.push('CONTRIB_KEYS=(' + rows.map((r) => r.key).join(' ') + ')');
-  lines.push('# contrib_row <key> -> echoes "payload|host|wire", empty if unknown.');
-  lines.push('contrib_row() {');
-  lines.push('  case "$1" in');
-  for (const r of rows) {
-    lines.push(`    ${r.key}) printf '%s' '${r.payload}|${r.host}|${r.wire}' ;;`);
-  }
-  lines.push("    *) return 0 ;;");
-  lines.push('  esac');
-  lines.push('}');
-  lines.push(END);
-  return lines.join('\n');
-}
-
-function splice(scriptText, block) {
-  const b = scriptText.indexOf(BEGIN);
-  const e = scriptText.indexOf(END);
-  if (b < 0 || e < 0) {
-    throw new Error('BEGIN/END GENERATED markers not found in target script');
-  }
-  const before = scriptText.slice(0, b);
-  const after = scriptText.slice(e + END.length);
-  return before + block + after;
-}
-
-const rows = readTable();
-const block = renderBlock(rows);
-
-const arg = process.argv[2];
-const target = process.argv[3];
-
-if (arg === '--write') {
-  const text = fs.readFileSync(target, 'utf-8');
-  fs.writeFileSync(target, splice(text, block));
-  console.error(`Wrote generated contribution table into ${target}`);
-} else if (arg === '--check') {
-  const text = fs.readFileSync(target, 'utf-8');
-  const expected = splice(text, block);
-  if (expected !== text) {
-    console.error(
-      `OUT OF SYNC: ${target} differs from contribution-table.ts. ` +
-        `Run: node scripts/generate-scan-packages-table.mjs --write ${target}`,
-    );
-    process.exit(1);
-  }
-  console.error(`${target} is in sync with the contribution table.`);
-} else {
-  process.stdout.write(block + '\n');
-}

package/scripts/smoke-sources-signals.sh

@@ -1,103 +0,0 @@
-#!/usr/bin/env bash
-#
-# smoke-sources-signals.sh — end-to-end verification of `hq sources` /
-# `hq signals` against a real vault bucket. Owned by US-008 of the
-# hq-cli-sources-signals PRD.
-#
-# Usage:
-#   # 1. Make sure you have a working Cognito session OR export a token:
-#   hq whoami            # interactive Cognito login if needed
-#   #   or: export HQ_ACCESS_TOKEN="$(...)"   # service-account JWT bypass
-#
-#   # 2. Run the smoke against an entity slug you have access to (default: indigo):
-#   ./scripts/smoke-sources-signals.sh              # uses ENTITY=indigo
-#   ENTITY=personal ./scripts/smoke-sources-signals.sh
-#
-# Behavior:
-#   Runs four CLI invocations, each asserted to exit 0 AND produce parseable
-#   JSON (where --format json is used). Stdout from each invocation is
-#   appended to a temp file; the script prints a summary table at the end.
-#
-# Exit codes:
-#   0  all four invocations succeeded and produced valid JSON
-#   1  one or more invocations failed (script aborts on first failure with set -e)
-#
-# Dependencies:
-#   - hq (built locally via `pnpm --filter @indigoai-us/hq-cli build`, or
-#     `npx @indigoai-us/hq-cli@rc ...` against a published rc)
-#   - jq (for JSON validation)
-#
-
-set -euo pipefail
-
-ENTITY="${ENTITY:-indigo}"
-LIMIT="${LIMIT:-5}"
-HQ_BIN="${HQ_BIN:-hq}"
-
-# Resolve workspace-local journal location for capturing output. The
-# operator running this script may redirect the script's stdout to a journal
-# file under companies/indigo/projects/hq-cli-sources-signals/journal/.
-SMOKE_TMP="$(mktemp -d -t hq-smoke-XXXXXX)"
-trap 'rm -rf "$SMOKE_TMP"' EXIT
-
-echo "==> hq sources/signals smoke for entity=$ENTITY limit=$LIMIT"
-echo "    binary: $HQ_BIN"
-echo "    tmpdir: $SMOKE_TMP"
-echo
-
-require_cmd() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "ERROR: required command '$1' not found in PATH" >&2
-    exit 1
-  fi
-}
-
-require_cmd "$HQ_BIN"
-require_cmd jq
-
-# --- 1. entities -----------------------------------------------------------
-echo "[1/4] hq sources entities"
-"$HQ_BIN" sources entities --format json > "$SMOKE_TMP/entities.json"
-jq -e 'type == "array"' "$SMOKE_TMP/entities.json" > /dev/null
-ENTITY_COUNT=$(jq 'length' "$SMOKE_TMP/entities.json")
-echo "      ok — $ENTITY_COUNT entity/entities visible"
-echo
-
-# --- 2. sources channels (no auth required) --------------------------------
-echo "[2/4] hq sources channels"
-"$HQ_BIN" sources channels > "$SMOKE_TMP/channels.txt"
-grep -qx 'meeting' "$SMOKE_TMP/channels.txt"
-grep -qx 'email' "$SMOKE_TMP/channels.txt"
-grep -qx 'slack' "$SMOKE_TMP/channels.txt"
-grep -qx 'linear' "$SMOKE_TMP/channels.txt"
-grep -qx 'notion' "$SMOKE_TMP/channels.txt"
-echo "      ok — all five canonical channels present"
-echo
-
-# --- 3. sources list --type meeting (the headline acceptance criterion) ---
-echo "[3/4] hq sources list --entity $ENTITY --type meeting --limit $LIMIT --format json"
-"$HQ_BIN" sources list \
-  --entity "$ENTITY" \
-  --type meeting \
-  --limit "$LIMIT" \
-  --format json > "$SMOKE_TMP/sources-list.json"
-jq -e '.entries | type == "array"' "$SMOKE_TMP/sources-list.json" > /dev/null
-SOURCE_COUNT=$(jq '.entries | length' "$SMOKE_TMP/sources-list.json")
-echo "      ok — $SOURCE_COUNT meeting source(s) listed"
-echo
-
-# --- 4. signals list --type action_item (the other headline) --------------
-echo "[4/4] hq signals list --entity $ENTITY --type action_item --limit $LIMIT --format json"
-"$HQ_BIN" signals list \
-  --entity "$ENTITY" \
-  --type action_item \
-  --limit "$LIMIT" \
-  --format json > "$SMOKE_TMP/signals-list.json"
-jq -e '.entries | type == "array"' "$SMOKE_TMP/signals-list.json" > /dev/null
-SIGNAL_COUNT=$(jq '.entries | length' "$SMOKE_TMP/signals-list.json")
-echo "      ok — $SIGNAL_COUNT action_item signal(s) listed"
-echo
-
-echo "==> SMOKE PASSED"
-echo "    entities=$ENTITY_COUNT  meeting_sources=$SOURCE_COUNT  action_item_signals=$SIGNAL_COUNT"
-echo "    raw outputs preserved in $SMOKE_TMP until process exit"

package/src/bin/hq-auth-refresh.ts

@@ -1,43 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Standalone `hq-auth-refresh` entry point.
- *
- * Exists so the deploy skill (.claude/skills/deploy/SKILL.md step 4) can
- * shell out to a plain binary instead of a subcommand. Equivalent to
- * `hq auth refresh`.
- *
- * Exit 0 if a valid session is ensured now (healthy cache hit, refresh, or
- * machine-token mint). Exit 1 if no valid session could be ensured
- * non-interactively.
- */
-
-// MUST be first: guard the Node version before any dependency that needs a
-// Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
-import "../node-preflight.js";
-import { initSentry, Sentry } from "../sentry.js";
-import { refreshCachedSession } from "../utils/cognito-session.js";
-
-initSentry();
-
-(async () => {
-  let exitCode = 1;
-  try {
-    const result = await refreshCachedSession();
-    if (result.refreshed) {
-      exitCode = 0;
-    } else {
-      if (result.reason) {
-        process.stderr.write(`hq-auth-refresh: ${result.reason}\n`);
-      }
-    }
-  } catch (err) {
-    Sentry.captureException(err);
-    process.stderr.write(
-      `hq-auth-refresh: ${err instanceof Error ? err.message : String(err)}\n`,
-    );
-  } finally {
-    await Sentry.flush(2000);
-    process.exit(exitCode);
-  }
-})();

package/src/cli-version.ts

@@ -1,13 +0,0 @@
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const pkgPath = path.resolve(here, "..", "package.json");
-const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as {
-  name: string;
-  version: string;
-};
-
-export const CLI_NAME: string = pkg.name;
-export const CLI_VERSION: string = pkg.version;

package/src/commands/__fixtures__/make-tar.ts

@@ -1,126 +0,0 @@
-/**
- * Deterministic, platform-independent malicious-tar fixture builder.
- *
- * WHY THIS EXISTS (cross-platform zip-slip coverage). The adversarial
- * safe-extract / marketplace-security suites need archives that GENUINELY carry
- * hostile entries — a `../` traversal name, an absolute path, an escaping
- * symlink/hardlink. The obvious approach (shell out to the system `tar` to
- * CREATE the archive) is NOT portable: GNU tar (Linux / CI / prod Lambdas)
- * STRIPS the leading `../` and absolute `/` when it WRITES an archive, so the
- * resulting "malicious" fixture contains a benign `evil-escape` entry and the
- * guard has nothing to reject — the test passes on macOS bsdtar (which
- * preserves them) but fails on Linux. The guard itself is correct; only the
- * fixture construction was platform-dependent.
- *
- * Fix: WRITE THE TAR BYTES DIRECTLY here. A tar archive is just a sequence of
- * 512-byte ustar headers, each optionally followed by the file's content padded
- * to a 512-byte boundary, terminated by two zero blocks. By emitting the bytes
- * ourselves we control the recorded entry names verbatim — `../evil-escape`,
- * `/tmp/evil`, a symlink with linkname `../../etc/passwd` — identically on every
- * platform, with no create-time stripping. The reading side (`tar -tvf`, which
- * safeExtractTarball's pre-flight uses) does NOT strip anything; it faithfully
- * lists whatever bytes we wrote, so the guard sees the real attack everywhere.
- */
-
-import { gzipSync } from 'node:zlib';
-import * as fs from 'node:fs';
-
-const BLOCK = 512;
-
-/** ustar typeflag values we use. */
-export type TarType = 'file' | 'symlink' | 'hardlink';
-
-const TYPEFLAG: Record<TarType, string> = {
-  file: '0', // regular file
-  symlink: '2', // symbolic link
-  hardlink: '1', // hard link
-};
-
-export interface TarEntrySpec {
-  /** Recorded entry name — written VERBATIM (may contain `..`, be absolute…). */
-  name: string;
-  type?: TarType; // default 'file'
-  /** For sym/hardlinks: the recorded link target (also written verbatim). */
-  linkname?: string;
-  /** File content (regular files only). */
-  content?: string | Buffer;
-}
-
-/** Write an ASCII string into a fixed-width field at `offset`, NUL-padded. */
-function writeField(buf: Buffer, offset: number, width: number, value: string): void {
-  // Truncate defensively; ustar fields are fixed-width.
-  const s = value.slice(0, width);
-  buf.write(s, offset, 'ascii');
-  // Remaining bytes are already 0 from Buffer.alloc.
-}
-
-/** Write an octal numeric field: `width-1` octal digits, space-or-NUL terminated. */
-function writeOctal(buf: Buffer, offset: number, width: number, value: number): void {
-  // Classic ustar numeric field: zero-padded octal in (width-1) chars + NUL.
-  const digits = width - 1;
-  const oct = value.toString(8).padStart(digits, '0').slice(-digits);
-  buf.write(oct, offset, 'ascii');
-  buf[offset + digits] = 0; // NUL terminator
-}
-
-/**
- * Build one 512-byte ustar header (plus content blocks for regular files) for a
- * single entry. The header checksum is computed exactly per spec: sum every
- * header byte treating the 8 checksum bytes themselves as ASCII spaces, then
- * write that sum as 6 octal digits + NUL + space.
- */
-export function makeTarEntry(spec: TarEntrySpec): Buffer {
-  const type = spec.type ?? 'file';
-  const content =
-    type === 'file'
-      ? Buffer.isBuffer(spec.content)
-        ? spec.content
-        : Buffer.from(spec.content ?? '', 'utf-8')
-      : Buffer.alloc(0); // links carry no content payload
-
-  const header = Buffer.alloc(BLOCK); // zero-filled
-
-  writeField(header, 0, 100, spec.name); // name
-  writeOctal(header, 100, 8, 0o644); // mode
-  writeOctal(header, 108, 8, 0); // uid
-  writeOctal(header, 116, 8, 0); // gid
-  writeOctal(header, 124, 12, content.length); // size (0 for links)
-  writeOctal(header, 136, 12, 0); // mtime (deterministic: epoch)
-  // checksum field (148, 8) — filled below; start as spaces for the sum.
-  header.fill(' '.charCodeAt(0), 148, 156);
-  writeField(header, 156, 1, TYPEFLAG[type]); // typeflag
-  if (spec.linkname !== undefined) {
-    writeField(header, 157, 100, spec.linkname); // linkname (verbatim)
-  }
-  writeField(header, 257, 6, 'ustar'); // magic "ustar\0"
-  writeField(header, 263, 2, '00'); // version "00"
-  // uname/gname left empty; devmajor/devminor zero (already NUL).
-
-  // Header checksum: unsigned sum of all 512 bytes (with the checksum field as
-  // spaces, which we set above). Written as 6 octal digits, NUL, space.
-  let sum = 0;
-  for (let i = 0; i < BLOCK; i++) sum += header[i];
-  const cksum = sum.toString(8).padStart(6, '0').slice(-6);
-  header.write(cksum, 148, 'ascii');
-  header[154] = 0; // NUL
-  header[155] = ' '.charCodeAt(0); // space
-
-  if (type !== 'file' || content.length === 0) return header;
-
-  // Content padded up to a 512-byte boundary.
-  const pad = (BLOCK - (content.length % BLOCK)) % BLOCK;
-  return Buffer.concat([header, content, Buffer.alloc(pad)]);
-}
-
-/** Concatenate entries and append the two zero blocks that end every tar. */
-export function makeTar(entries: TarEntrySpec[]): Buffer {
-  const blocks = entries.map(makeTarEntry);
-  blocks.push(Buffer.alloc(BLOCK * 2)); // end-of-archive marker
-  return Buffer.concat(blocks);
-}
-
-/** Build the tar, gzip it, and write it to `outPath`. Returns `outPath`. */
-export function writeMaliciousTarGz(outPath: string, entries: TarEntrySpec[]): string {
-  fs.writeFileSync(outPath, gzipSync(makeTar(entries)));
-  return outPath;
-}

package/src/commands/_patterns.ts

@@ -1,10 +0,0 @@
-export const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/;
-export const GROUP_ID_PATTERN = /^grp_[A-Za-z0-9_-]+$/;
-export const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
-
-export function normalizeFilePrefix(prefix: string): string {
-  if (prefix.endsWith("/")) {
-    return prefix + "*";
-  }
-  return prefix;
-}

package/src/commands/add.ts

@@ -1,75 +0,0 @@
-/**
- * hq modules add command (US-003)
- */
-
-import { Command } from 'commander';
-import { findHqRoot, addModule, parseRepoName, isValidRepoUrl } from '../utils/manifest.js';
-import type { LegacyModuleDefinition, LegacyStrategy } from '../types.js';
-
-export function registerAddCommand(program: Command): void {
-  program
-    .command('add <repo-url>')
-    .description('Add a module to the manifest')
-    .option('--as <name>', 'Module name (defaults to repo name)')
-    .option('--branch <branch>', 'Git branch to track', 'main')
-    .option('--strategy <strategy>', 'Sync strategy: link | merge | copy', 'link')
-    .option('--path <mapping>', 'Path mapping src:dest (can repeat)', (val, prev: string[]) => [...prev, val], [])
-    .action(async (repoUrl: string, options: {
-      as?: string;
-      branch: string;
-      strategy: string;
-      path: string[];
-    }) => {
-      try {
-        // Validate repo URL
-        if (!isValidRepoUrl(repoUrl)) {
-          console.error('Error: Invalid repo URL. Must start with https:// or git@');
-          process.exit(1);
-        }
-
-        // Parse name
-        const name = options.as || parseRepoName(repoUrl);
-
-        // Validate strategy (hq modules add is for legacy git-repo modules;
-        // content packs are added via `hq install`, not `hq modules add`)
-        const validStrategies: LegacyStrategy[] = ['link', 'merge', 'copy'];
-        if (!validStrategies.includes(options.strategy as LegacyStrategy)) {
-          console.error(`Error: Invalid strategy "${options.strategy}". Use: ${validStrategies.join(', ')}`);
-          process.exit(1);
-        }
-
-        // Parse path mappings
-        const paths = options.path.length > 0
-          ? options.path.map(p => {
-              const [src, dest] = p.split(':');
-              if (!src || !dest) {
-                throw new Error(`Invalid path mapping: ${p}. Format: src:dest`);
-              }
-              return { src, dest };
-            })
-          : [{ src: '.', dest: `workers/${name}` }]; // Default: entire repo to workers/
-
-        const module: LegacyModuleDefinition = {
-          name,
-          repo: repoUrl,
-          branch: options.branch,
-          strategy: options.strategy as LegacyStrategy,
-          paths,
-        };
-
-        const hqRoot = findHqRoot();
-        addModule(hqRoot, module);
-
-        console.log(`Added module "${name}"`);
-        console.log(`  Repo: ${repoUrl}`);
-        console.log(`  Branch: ${options.branch}`);
-        console.log(`  Strategy: ${options.strategy}`);
-        console.log(`  Paths: ${paths.map(p => `${p.src} -> ${p.dest}`).join(', ')}`);
-        console.log('\nRun "hq modules sync" to fetch and sync the module.');
-
-      } catch (error) {
-        console.error('Error:', error instanceof Error ? error.message : error);
-        process.exit(1);
-      }
-    });
-}