@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/commands/pkg-install.ts

@@ -1,221 +0,0 @@
-/**
- * hq packages install <slug> — download, verify, and extract a package (US-005)
- *
- * Flow:
- * 1. Check auth (prompt login if needed)
- * 2. Check entitlement via API
- * 3. Download tarball via presigned URL
- * 4. Verify SHA256 hash
- * 5. Verify RSA signature (if provided)
- * 6. Extract to packages/installed/<slug>/
- * 7. Validate extracted package.yaml slug matches
- * 8. Update packages/registry.yaml
- * 9. Print next-step message
- */
-
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { parseUserYaml } from '../utils/user-yaml-error.js';
-import { execSync } from 'child_process';
-import { Command } from 'commander';
-import chalk from 'chalk';
-import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
-import {
-  getRegistryUrl,
-  RegistryClient,
-} from '../utils/registry-client.js';
-import { verifySha256, verifyRsaSignature } from '../utils/integrity.js';
-import { addToRegistry } from '../utils/registry.js';
-import { assertCognitoOnlyCommand } from '../utils/resolve-vault-credential.js';
-import {
-  MARKETPLACE_PREFIX,
-  installPack,
-  sourceMatchesPackPattern,
-} from './pack-install.js';
-
-export function registerPackageInstallCommand(parent: Command): void {
-  parent
-    .command('install <source>')
-    .description(
-      'Install a package. Sources: bare slug (registry, Cognito-gated), ' +
-        '@scope/name[@ver] (npm pack), git URL[#ref], or local path.'
-    )
-    .option('--company <co>', 'Scope package secret authorization to a specific company')
-    .option('--allow-hooks', 'Skip the hooks confirmation prompt (content-pack flow)')
-    .option('--allow-mcp', 'Skip the MCP server confirmation prompt (content-pack flow)')
-    .option('--branch', 'Follow a ref instead of SHA-pinning (git content-pack flow)')
-    .action(
-      async (
-        source: string,
-        opts: { company?: string; allowHooks?: boolean; allowMcp?: boolean; branch?: boolean }
-      ) => {
-        try {
-          // Gate the top-level `hq install` entrypoint only — `installPack`
-          // itself is also called by `hq packs update` (packs.ts), which must
-          // stay able to fail closed at its OWN call site (before it un-wires
-          // an existing pack) rather than mid-flight inside installPack.
-          assertCognitoOnlyCommand('hq install');
-          if (sourceMatchesPackPattern(source)) {
-            await installPack(source, {
-              company: opts.company,
-              allowHooks: opts.allowHooks,
-              allowMcp: opts.allowMcp,
-              followBranch: opts.branch,
-            });
-          } else {
-            // Bare slugs: the legacy Cognito-gated registry backend
-            // (/packages, /entitlements) was never deployed, so a bare slug
-            // would fail at registry setup. Resolve it through the marketplace
-            // listings transport — the live install path — instead.
-            await installPack(`${MARKETPLACE_PREFIX}${source}`, {
-              company: opts.company,
-              allowHooks: opts.allowHooks,
-              allowMcp: opts.allowMcp,
-              followBranch: opts.branch,
-            });
-          }
-        } catch (error) {
-          console.error(
-            chalk.red('Install failed:'),
-            error instanceof Error ? error.message : 'Unknown error'
-          );
-          process.exit(1);
-        }
-      }
-    );
-}
-
-async function installPackage(
-  slug: string,
-  company?: string
-): Promise<void> {
-  // 1. Auth
-  const accessToken = await ensureCognitoToken();
-  const registryUrl = getRegistryUrl();
-  const client = new RegistryClient(registryUrl, accessToken);
-
-  // 2. Check entitlement
-  console.log(chalk.dim(`Checking entitlement for ${slug}...`));
-  const entitlement = await client.checkEntitlement(slug);
-  if (!entitlement.entitled) {
-    throw new Error(
-      `You are not entitled to package "${slug}". Visit the registry to purchase or request access.`
-    );
-  }
-
-  // 3. Get download URL
-  console.log(chalk.dim('Fetching download URL...'));
-  const download = await client.getDownloadUrl(slug);
-
-  // 4. Download to temp file
-  const tmpDir = os.tmpdir();
-  const tmpFile = path.resolve(tmpDir, `hq-pkg-${slug}-${Date.now()}.tar.gz`);
-
-  try {
-    console.log(chalk.dim('Downloading package...'));
-    const response = await fetch(download.url, {
-      signal: AbortSignal.timeout(120_000),
-    });
-
-    if (!response.ok) {
-      throw new Error(`Download failed (${response.status})`);
-    }
-
-    const buffer = Buffer.from(await response.arrayBuffer());
-    fs.writeFileSync(tmpFile, buffer);
-
-    // 5. Verify SHA256
-    console.log(chalk.dim('Verifying integrity...'));
-    const hashValid = await verifySha256(tmpFile, download.sha256);
-    if (!hashValid) {
-      throw new Error(
-        'SHA256 hash mismatch — the downloaded file may be corrupted or tampered with.'
-      );
-    }
-
-    // 6. Verify RSA signature (if provided)
-    if (download.signature) {
-      const sigValid = verifyRsaSignature(download.sha256, download.signature);
-      if (!sigValid) {
-        throw new Error(
-          'RSA signature verification failed — the package may have been tampered with or the public key is missing/invalid. Aborting install.'
-        );
-      }
-    }
-
-    // 7. Extract
-    const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-    const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
-
-    // Clean existing installation
-    if (fs.existsSync(installDir)) {
-      fs.rmSync(installDir, { recursive: true, force: true });
-    }
-    fs.mkdirSync(installDir, { recursive: true });
-
-    execSync(`tar -xzf "${tmpFile}" -C "${installDir}"`, {
-      stdio: 'pipe',
-    });
-
-    // 8. Validate package.yaml slug
-    const packageYamlPath = path.resolve(installDir, 'package.yaml');
-    if (fs.existsSync(packageYamlPath)) {
-      const pkgContent = fs.readFileSync(packageYamlPath, 'utf-8');
-      const pkgMeta = parseUserYaml<{ slug?: string } | null>(pkgContent, packageYamlPath);
-      if (pkgMeta?.slug && pkgMeta.slug !== slug) {
-        // Mismatch — clean up and abort
-        fs.rmSync(installDir, { recursive: true, force: true });
-        throw new Error(
-          `Package slug mismatch: expected "${slug}", got "${pkgMeta.slug}"`
-        );
-      }
-    }
-
-    // 9. Get package info for registry entry
-    let version = 'unknown';
-    let name = slug;
-    try {
-      const pkgInfo = await client.getPackage(slug);
-      version = pkgInfo.package.latest_version;
-      name = pkgInfo.package.name;
-    } catch {
-      // Best-effort — fall back to package.yaml if present
-      const packageYaml = path.resolve(installDir, 'package.yaml');
-      if (fs.existsSync(packageYaml)) {
-        const content = fs.readFileSync(packageYaml, 'utf-8');
-        const meta = parseUserYaml<{
-          version?: string;
-          name?: string;
-        } | null>(content, packageYaml);
-        if (meta?.version) version = meta.version;
-        if (meta?.name) name = meta.name;
-      }
-    }
-
-    // 10. Update registry.yaml
-    const now = new Date().toISOString();
-    addToRegistry(hqRoot, {
-      name,
-      slug,
-      version,
-      source: registryUrl,
-      scope: company,
-      installed_at: now,
-      updated_at: now,
-    });
-
-    console.log(chalk.green(`\nInstalled ${slug}@${version} to packages/installed/${slug}/`));
-    console.log(
-      chalk.cyan(
-        'Run /package-install ' + slug + ' in Claude to merge into your HQ.'
-      )
-    );
-  } finally {
-    // Clean up temp file — never leave partial downloads
-    if (fs.existsSync(tmpFile)) {
-      fs.unlinkSync(tmpFile);
-    }
-  }
-}

package/src/commands/pkg-list.test.ts

@@ -1,79 +0,0 @@
-// @vitest-environment node
-/**
- * Regression: `hq packages list` must use the same filesystem-backed pack
- * discovery as `hq packs list`, matching the live package install path.
- */
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { Command } from 'commander';
-
-vi.mock('./pack-install.js', () => ({
-  classify: vi.fn(() => 'local'),
-  resolveLatest: vi.fn(),
-  resolveLatestMarketplace: vi.fn(),
-  runScanPackages: vi.fn(),
-  installPack: vi.fn(),
-}));
-
-import { registerPackageListCommand } from './pkg-list.js';
-import { registerPacksCommand } from './packs.js';
-
-describe('hq packages list content-pack discovery', () => {
-  let hqRoot: string;
-  let previousCwd: string;
-
-  beforeEach(() => {
-    hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'hq-pkg-list-'));
-    previousCwd = process.cwd();
-    fs.mkdirSync(path.join(hqRoot, '.claude'));
-    fs.mkdirSync(path.join(hqRoot, 'companies'));
-    fs.mkdirSync(path.join(hqRoot, 'core', 'packages', 'hq-pack-fixture'), {
-      recursive: true,
-    });
-    fs.writeFileSync(path.join(hqRoot, 'core', 'core.yaml'), 'hqVersion: 14.0.0\n');
-    fs.writeFileSync(
-      path.join(hqRoot, 'core', 'packages', 'hq-pack-fixture', 'package.yaml'),
-      'name: hq-pack-fixture\nversion: 1.2.3\n',
-    );
-    process.chdir(hqRoot);
-  });
-
-  afterEach(() => {
-    process.chdir(previousCwd);
-    fs.rmSync(hqRoot, { recursive: true, force: true });
-    vi.restoreAllMocks();
-  });
-
-  async function captureJson(register: (program: Command) => void, args: string[]) {
-    const stdout = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
-    const program = new Command();
-    program.exitOverride();
-    register(program);
-    await program.parseAsync(args, { from: 'user' });
-    const output = stdout.mock.calls.map((call) => String(call[0])).join('');
-    stdout.mockRestore();
-    return JSON.parse(output) as {
-      installed: Array<{ name: string; version?: string }>;
-    };
-  }
-
-  it('reports a pack installed under core/packages through both list commands', async () => {
-    const packagesView = await captureJson(
-      (program) => {
-        const packages = program.command('packages');
-        registerPackageListCommand(packages);
-      },
-      ['packages', 'list', '--json'],
-    );
-    const packsView = await captureJson(registerPacksCommand, ['packs', 'list', '--json']);
-
-    expect(packagesView.installed).toContainEqual(
-      expect.objectContaining({ name: 'hq-pack-fixture', version: '1.2.3' }),
-    );
-    expect(packsView.installed).toContainEqual(
-      expect.objectContaining({ name: 'hq-pack-fixture', version: '1.2.3' }),
-    );
-  });
-});

package/src/commands/pkg-list.ts

@@ -1,13 +0,0 @@
-/**
- * hq packages list — list filesystem-backed content packs.
- *
- * Package installs use the content-pack installer, so this command delegates
- * to the same list view as `hq packs list`.
- */
-
-import { Command } from 'commander';
-import { registerPacksListCommand } from './packs.js';
-
-export function registerPackageListCommand(parent: Command): void {
-  registerPacksListCommand(parent);
-}

package/src/commands/pkg-remove.ts

@@ -1,71 +0,0 @@
-/**
- * hq packages remove <slug> — archive and unregister a package (US-005)
- *
- * 1. Archive packages/installed/<slug>/ to packages/.archive/<slug>-<timestamp>/
- * 2. Remove entry from packages/registry.yaml
- * 3. Print next-step message
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-import { Command } from 'commander';
-import chalk from 'chalk';
-import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
-import { removeFromRegistry, readRegistry } from '../utils/registry.js';
-
-export function registerPackageRemoveCommand(parent: Command): void {
-  parent
-    .command('remove <slug>')
-    .description('Remove an installed package (archives it first)')
-    .action(async (slug: string) => {
-      try {
-        await removePackage(slug);
-      } catch (error) {
-        console.error(
-          chalk.red('Remove failed:'),
-          error instanceof Error ? error.message : 'Unknown error'
-        );
-        process.exit(1);
-      }
-    });
-}
-
-async function removePackage(slug: string): Promise<void> {
-  const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-  const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
-
-  // Verify it is actually installed
-  const entries = readRegistry(hqRoot);
-  const entry = entries.find((e) => e.slug === slug);
-  if (!entry && !fs.existsSync(installDir)) {
-    throw new Error(`Package "${slug}" is not installed.`);
-  }
-
-  // 1. Archive
-  if (fs.existsSync(installDir)) {
-    const timestamp = new Date()
-      .toISOString()
-      .replace(/[:.]/g, '-')
-      .replace('T', '_')
-      .slice(0, 19);
-    const archiveDir = path.resolve(
-      hqRoot,
-      'packages',
-      '.archive',
-      `${slug}-${timestamp}`
-    );
-    fs.mkdirSync(path.dirname(archiveDir), { recursive: true });
-    fs.renameSync(installDir, archiveDir);
-    console.log(chalk.dim(`Archived to packages/.archive/${slug}-${timestamp}/`));
-  }
-
-  // 2. Remove from registry.yaml
-  removeFromRegistry(hqRoot, slug);
-
-  console.log(chalk.green(`\nRemoved ${slug}.`));
-  console.log(
-    chalk.cyan(
-      'Run /package-remove ' + slug + ' in Claude to clean up merged content.'
-    )
-  );
-}

package/src/commands/pkg-update.ts

@@ -1,189 +0,0 @@
-/**
- * hq packages update [slug] — check for and apply package updates (US-005)
- *
- * If no slug: check all installed packages for updates.
- * If slug given: update only that package.
- */
-
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { parseUserYaml } from '../utils/user-yaml-error.js';
-import { execSync } from 'child_process';
-import { Command } from 'commander';
-import chalk from 'chalk';
-import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
-import {
-  getRegistryUrl,
-  RegistryClient,
-} from '../utils/registry-client.js';
-import { verifySha256, verifyRsaSignature } from '../utils/integrity.js';
-import {
-  readRegistry,
-  addToRegistry,
-  type RegistryEntry,
-} from '../utils/registry.js';
-
-export function registerPackageUpdateCommand(parent: Command): void {
-  parent
-    .command('update [slug]')
-    .description('Check for and apply package updates')
-    .action(async (slug?: string) => {
-      try {
-        await updatePackages(slug);
-      } catch (error) {
-        console.error(
-          chalk.red('Update failed:'),
-          error instanceof Error ? error.message : 'Unknown error'
-        );
-        process.exit(1);
-      }
-    });
-}
-
-async function updatePackages(slug?: string): Promise<void> {
-  const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-  const entries = readRegistry(hqRoot);
-
-  if (entries.length === 0) {
-    console.log('No packages installed. Use "hq packages install <slug>" to install one.');
-    return;
-  }
-
-  const accessToken = await ensureCognitoToken();
-  const registryUrl = getRegistryUrl();
-  const client = new RegistryClient(registryUrl, accessToken);
-
-  const toCheck = slug
-    ? entries.filter((e) => e.slug === slug)
-    : entries;
-
-  if (slug && toCheck.length === 0) {
-    throw new Error(`Package "${slug}" is not installed.`);
-  }
-
-  let updatedCount = 0;
-
-  for (const entry of toCheck) {
-    try {
-      const pkgInfo = await client.getPackage(entry.slug);
-      const latestVersion = pkgInfo.package.latest_version;
-
-      if (latestVersion === entry.version) {
-        console.log(chalk.dim(`${entry.slug}@${entry.version} — up to date`));
-        continue;
-      }
-
-      console.log(
-        chalk.yellow(
-          `${entry.slug}: ${entry.version} → ${latestVersion}`
-        )
-      );
-
-      // Download new version
-      const download = await client.getDownloadUrl(
-        entry.slug,
-        latestVersion
-      );
-
-      const tmpFile = path.resolve(
-        os.tmpdir(),
-        `hq-pkg-${entry.slug}-${Date.now()}.tar.gz`
-      );
-
-      try {
-        const response = await fetch(download.url, {
-          signal: AbortSignal.timeout(120_000),
-        });
-
-        if (!response.ok) {
-          throw new Error(`Download failed (${response.status})`);
-        }
-
-        const buffer = Buffer.from(await response.arrayBuffer());
-        fs.writeFileSync(tmpFile, buffer);
-
-        // Verify SHA256
-        const hashValid = await verifySha256(tmpFile, download.sha256);
-        if (!hashValid) {
-          throw new Error('SHA256 hash mismatch');
-        }
-
-        // Verify RSA signature (if provided)
-        if (download.signature) {
-          const sigValid = verifyRsaSignature(
-            download.sha256,
-            download.signature
-          );
-          if (!sigValid) {
-            console.warn(
-              chalk.yellow(
-                `  Warning: RSA signature verification failed for ${entry.slug}. Proceeding with SHA256-only.`
-              )
-            );
-          }
-        }
-
-        // Extract over existing
-        const installDir = path.resolve(
-          hqRoot,
-          'packages',
-          'installed',
-          entry.slug
-        );
-
-        if (fs.existsSync(installDir)) {
-          fs.rmSync(installDir, { recursive: true, force: true });
-        }
-        fs.mkdirSync(installDir, { recursive: true });
-
-        execSync(`tar -xzf "${tmpFile}" -C "${installDir}"`, {
-          stdio: 'pipe',
-        });
-
-        // Validate package.yaml slug
-        const packageYamlPath = path.resolve(installDir, 'package.yaml');
-        if (fs.existsSync(packageYamlPath)) {
-          const pkgContent = fs.readFileSync(packageYamlPath, 'utf-8');
-          const pkgMeta = parseUserYaml<{
-            slug?: string;
-          } | null>(pkgContent, packageYamlPath);
-          if (pkgMeta?.slug && pkgMeta.slug !== entry.slug) {
-            fs.rmSync(installDir, { recursive: true, force: true });
-            throw new Error(
-              `Package slug mismatch: expected "${entry.slug}", got "${pkgMeta.slug}"`
-            );
-          }
-        }
-
-        // Update registry entry — preserve scope
-        const now = new Date().toISOString();
-        const updated: RegistryEntry = {
-          ...entry,
-          version: latestVersion,
-          updated_at: now,
-        };
-        addToRegistry(hqRoot, updated);
-
-        console.log(
-          chalk.green(`  Updated ${entry.slug} to ${latestVersion}`)
-        );
-        updatedCount++;
-      } finally {
-        if (fs.existsSync(tmpFile)) {
-          fs.unlinkSync(tmpFile);
-        }
-      }
-    } catch (error) {
-      console.error(
-        chalk.red(`  Error updating ${entry.slug}:`),
-        error instanceof Error ? error.message : 'Unknown error'
-      );
-    }
-  }
-
-  console.log(
-    `\n${updatedCount} package(s) updated${updatedCount > 0 ? '.' : ' — everything is current.'}`
-  );
-}