@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/commands/rescue.ts

@@ -1,210 +0,0 @@
-/**
- * hq rescue — re-sync the local HQ core to an upstream hq-core release (or the
- * staging branch) WITHOUT destroying local edits ("drift").
- *
- * Thin driver over @indigoai-us/hq-cloud's `rescue()`, which execs the bundled
- * scripts/replace-rescue.sh against the HQ root. This is the CLI sibling of the
- * HQ Sync menubar app's "Update / Restore" pill — both drive the exact same
- * rescue script, just resolved from the shared hq-cloud package.
- *
- * Prod (default): resolves the latest `indigoai-us/hq-core` release tag and
- * pins the three-way history floor to the commit of the user's currently
- * installed version (read from core/core.yaml). Staging (`--staging`): targets
- * `indigoai-us/hq-core-staging@main` and lets the script read its on-disk
- * sync stamp for the floor.
- */
-import { Command } from 'commander';
-import { spawnSync } from 'child_process';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as yaml from 'js-yaml';
-import chalk from 'chalk';
-import { rescue } from '@indigoai-us/hq-cloud';
-import { findHqRoot } from '../utils/manifest.js';
-
-const PROD_SOURCE = 'indigoai-us/hq-core';
-const STAGING_SOURCE = 'indigoai-us/hq-core-staging';
-
-export interface RescueTarget {
-  source: string;
-  /** undefined → let the script apply its own default ref (`main`). */
-  ref?: string;
-}
-
-/**
- * Resolve the source repo + ref from the user's flags. Pure + exported for
- * tests. `latestTag` is the resolved latest release tag (prod only); ignored
- * for staging and when an explicit `--ref` is given.
- */
-export function resolveRescueTarget(
-  opts: { staging?: boolean; source?: string; ref?: string },
-  latestTag?: string
-): RescueTarget {
-  if (opts.staging) {
-    return { source: opts.source ?? STAGING_SOURCE, ref: opts.ref };
-  }
-  return { source: opts.source ?? PROD_SOURCE, ref: opts.ref ?? latestTag };
-}
-
-/** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
-function resolveGhToken(): string | undefined {
-  try {
-    const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
-    if (res.status === 0) {
-      const tok = res.stdout.trim();
-      if (tok) return tok;
-    }
-  } catch {
-    // gh not installed — fall through to env.
-  }
-  return process.env.GH_TOKEN || process.env.GITHUB_TOKEN || undefined;
-}
-
-function ghHeaders(token?: string): Record<string, string> {
-  const headers: Record<string, string> = {
-    Accept: 'application/vnd.github+json',
-    'User-Agent': 'hq-cli-rescue',
-    'X-GitHub-Api-Version': '2022-11-28',
-  };
-  if (token) headers.Authorization = `Bearer ${token}`;
-  return headers;
-}
-
-/** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
-async function getLatestReleaseTag(repo: string, token?: string): Promise<string> {
-  const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
-    headers: ghHeaders(token),
-  });
-  if (!res.ok) {
-    throw new Error(`GitHub releases/latest for ${repo}: HTTP ${res.status}`);
-  }
-  const body = (await res.json()) as { tag_name?: string };
-  if (!body.tag_name) throw new Error(`no tag_name in latest release for ${repo}`);
-  return body.tag_name;
-}
-
-/** Resolve a tag to its commit SHA, dereferencing annotated tags. */
-async function resolveTagSha(repo: string, tag: string, token?: string): Promise<string> {
-  const refRes = await fetch(
-    `https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`,
-    { headers: ghHeaders(token) }
-  );
-  if (!refRes.ok) throw new Error(`git/ref/tags/${tag} for ${repo}: HTTP ${refRes.status}`);
-  const ref = (await refRes.json()) as { object?: { type?: string; sha?: string } };
-  const obj = ref.object;
-  if (!obj?.sha) throw new Error(`no object.sha for tag ${tag} in ${repo}`);
-  if (obj.type !== 'tag') return obj.sha; // lightweight tag → already a commit
-  // Annotated tag → dereference to the commit it points at.
-  const tagRes = await fetch(`https://api.github.com/repos/${repo}/git/tags/${obj.sha}`, {
-    headers: ghHeaders(token),
-  });
-  if (!tagRes.ok) throw new Error(`git/tags/${obj.sha} for ${repo}: HTTP ${tagRes.status}`);
-  const annotated = (await tagRes.json()) as { object?: { sha?: string } };
-  if (!annotated.object?.sha) throw new Error(`annotated tag ${tag} has no target sha`);
-  return annotated.object.sha;
-}
-
-/** Read the installed HQ core version from `{hqRoot}/core/core.yaml`. */
-function readInstalledVersion(hqRoot: string): string | undefined {
-  const file = path.join(hqRoot, 'core', 'core.yaml');
-  if (!fs.existsSync(file)) return undefined;
-  try {
-    const doc = yaml.load(fs.readFileSync(file, 'utf8')) as { hqVersion?: unknown } | null;
-    const v = doc?.hqVersion;
-    return typeof v === 'string' ? v : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-export function registerRescueCommand(program: Command): void {
-  program
-    .command('rescue')
-    .description(
-      'Re-sync your HQ core to the latest release, preserving your local edits (drift)'
-    )
-    .option('--hq-root <path>', 'HQ root to operate on (defaults to auto-detected root)')
-    .option('--ref <ref>', 'Target tag/branch (default: latest hq-core release)')
-    .option('--source <repo>', 'Source repo (default: indigoai-us/hq-core)')
-    .option('--staging', 'Use the staging channel (indigoai-us/hq-core-staging@main)')
-    .option('--floor-sha <sha>', 'Pin the three-way history floor to a 40-char commit SHA')
-    .option('--paths <list>', 'Comma-separated top-level paths to narrow the rescue to')
-    .option('--check', 'Plan only — classify and report, change nothing on disk (--dry-run)')
-    .option('-y, --yes', 'Skip the confirmation prompt')
-    .option('--no-backup', 'Skip the pre-op safety snapshot under ~/.hq/backups')
-    .option('--cloud-update', 'Cloud-update mode')
-    .action(
-      async (opts: {
-        hqRoot?: string;
-        ref?: string;
-        source?: string;
-        staging?: boolean;
-        floorSha?: string;
-        paths?: string;
-        check?: boolean;
-        yes?: boolean;
-        backup?: boolean; // --no-backup → false
-        cloudUpdate?: boolean;
-      }) => {
-        try {
-          const hqRoot = opts.hqRoot ?? findHqRoot();
-          const token = resolveGhToken();
-
-          let { source, ref } = resolveRescueTarget(opts);
-          let floorSha = opts.floorSha;
-
-          if (!opts.staging) {
-            // Prod: resolve the latest release tag when no explicit ref, and
-            // pin the floor to the installed version's commit when possible.
-            if (!ref) {
-              ref = await getLatestReleaseTag(source, token);
-            }
-            if (!floorSha) {
-              const installed = readInstalledVersion(hqRoot);
-              if (installed) {
-                try {
-                  floorSha = await resolveTagSha(source, `v${installed}`, token);
-                } catch (err) {
-                  console.warn(
-                    chalk.yellow(
-                      `Warning: couldn't resolve the floor commit for v${installed} ` +
-                        `(${err instanceof Error ? err.message : 'unknown error'}); ` +
-                        `falling back to the on-disk sync stamp.`
-                    )
-                  );
-                }
-              }
-            }
-          }
-
-          console.log(
-            chalk.dim(
-              `Rescuing ${hqRoot} from ${source}${ref ? `@${ref}` : ''}` +
-                `${floorSha ? ` (floor ${floorSha.slice(0, 12)})` : ''}` +
-                `${opts.check ? ' [dry-run]' : ''}`
-            )
-          );
-
-          const { status } = rescue({
-            hqRoot,
-            source,
-            ref,
-            floorSha,
-            paths: opts.paths ? opts.paths.split(',').map((p) => p.trim()).filter(Boolean) : undefined,
-            dryRun: opts.check,
-            assumeYes: opts.yes,
-            noBackup: opts.backup === false,
-            cloudUpdate: opts.cloudUpdate,
-            ghToken: token,
-          });
-          process.exit(status);
-        } catch (error) {
-          console.error(
-            chalk.red('Error:'),
-            error instanceof Error ? error.message : 'Unknown error'
-          );
-          process.exit(1);
-        }
-      }
-    );
-}

package/src/commands/run.env-local.test.ts

@@ -1,88 +0,0 @@
-import { afterEach, beforeEach, expect, test, vi } from 'vitest';
-import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { internal } from 'varlock';
-import { discoverSchemas } from '../run/discover-schemas.js';
-import { installHqPlugin, prewarmHqSecrets, type PluginState } from '../run/hq-plugin.js';
-
-vi.mock('../utils/secrets-cache.js', () => {
-  const store = new Map<string, string>();
-  return {
-    DEFAULT_SECRETS_CACHE_TTL_MS: 300000,
-    readCache: (uid: string, name: string): string | null =>
-      store.get(`${uid}\0${name}`) ?? null,
-    writeCache: (uid: string, name: string, value: string): void => {
-      store.set(`${uid}\0${name}`, value);
-    },
-    removeCacheEntry: (): void => {},
-    clearAllCache: (): { removed: number } => ({ removed: 0 }),
-  };
-});
-
-let dir: string;
-
-beforeEach(() => {
-  dir = mkdtempSync(join(tmpdir(), 'hq-run-envlocal-'));
-});
-
-afterEach(() => {
-  rmSync(dir, { recursive: true, force: true });
-});
-
-test('.env.local overrides hq()-resolved value', async () => {
-  // Blank line after @hqCompany required: varlock only treats it as a root (file-level)
-  // decorator when separated from the first var by a blank line.
-  writeFileSync(join(dir, '.env.schema'), '# @hqCompany("indigo")\n\n# @required\nKEY=hq()\n');
-  writeFileSync(join(dir, '.env.local'), 'KEY=local-value\n');
-
-  const result = discoverSchemas(dir);
-  expect(result.schemaPaths).toEqual([join(dir, '.env.schema')]);
-  expect(result.envLocalPaths).toEqual([join(dir, '.env.local')]);
-
-  const paths = [...result.schemaPaths, ...result.envLocalPaths];
-  const opts = {
-    companyOverride: undefined,
-    resolveCompanyUid: async () => 'fake-uid',
-    // fetchBatch returns "vault-value" — if .env.local is correctly wired,
-    // graph resolution should still surface "local-value" because the local
-    // file wins precedence.
-    fetchBatch: async () => ({
-      secrets: [{ name: 'KEY', value: 'vault-value', cacheTtlMs: 0 }],
-      errors: [],
-    }),
-  };
-
-  let state!: PluginState;
-  const graph = await internal.loadEnvGraph({
-    entryFilePaths: paths,
-    afterInit: (g) => { state = installHqPlugin(g, opts); },
-  });
-  await prewarmHqSecrets(graph, opts, state);
-  await graph.resolveEnvValues();
-  expect(graph.getResolvedEnvObject().KEY).toBe('local-value');
-});
-
-test('without .env.local, vault value is returned', async () => {
-  writeFileSync(join(dir, '.env.schema'), '# @hqCompany("indigo")\n\n# @required\nKEY=hq()\n');
-
-  const result = discoverSchemas(dir);
-  expect(result.schemaPaths).toEqual([join(dir, '.env.schema')]);
-  expect(result.envLocalPaths).toEqual([]);
-
-  const paths = [...result.schemaPaths, ...result.envLocalPaths];
-  const opts = {
-    companyOverride: undefined,
-    resolveCompanyUid: async () => 'fake-uid',
-    fetchBatch: async () => ({ secrets: [{ name: 'KEY', value: 'vault-value' }], errors: [] }),
-  };
-
-  let state!: PluginState;
-  const graph = await internal.loadEnvGraph({
-    entryFilePaths: paths,
-    afterInit: (g) => { state = installHqPlugin(g, opts); },
-  });
-  await prewarmHqSecrets(graph, opts, state);
-  await graph.resolveEnvValues();
-  expect(graph.getResolvedEnvObject().KEY).toBe('vault-value');
-});

package/src/commands/run.test.ts

@@ -1,45 +0,0 @@
-import { createHash } from "node:crypto";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { buildRunUsage } from "./run.js";
-
-describe("hq run script usage", () => {
-  let tempDir: string;
-
-  beforeEach(() => {
-    tempDir = mkdtempSync(join(tmpdir(), "hq-run-usage-test-"));
-  });
-
-  afterEach(() => {
-    rmSync(tempDir, { recursive: true, force: true });
-  });
-
-  it("preserves a custom relative script id while resolving and hashing the file", async () => {
-    const scriptPath = join(tempDir, "deploy.sh");
-    const scriptBody = "#!/usr/bin/env bash\necho deploy\n";
-    writeFileSync(scriptPath, scriptBody);
-
-    const usage = await buildRunUsage(
-      scriptPath,
-      "scripts/deploy.sh",
-    );
-
-    expect(usage).toEqual({
-      channel: "run",
-      script: {
-        scriptId: "scripts/deploy.sh",
-        path: resolve(scriptPath),
-        sha256: createHash("sha256").update(scriptBody).digest("hex"),
-        attestationLevel: "self-asserted-hash",
-      },
-    });
-  });
-
-  it("rejects a script id when no script path can be attested", async () => {
-    await expect(buildRunUsage(undefined, "deploy-script")).rejects.toThrow(
-      "--script-id requires --script",
-    );
-  });
-});

package/src/commands/run.ts

@@ -1,190 +0,0 @@
-import { Command } from 'commander';
-import { spawn } from 'node:child_process';
-import * as path from 'node:path';
-import * as fs from 'node:fs';
-import { internal } from 'varlock';
-import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { peekHqApiKey } from '../utils/resolve-vault-credential.js';
-import { computeSha256 } from '../utils/integrity.js';
-import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
-import { discoverSchemas } from '../run/discover-schemas.js';
-import { installHqPlugin, prewarmHqSecrets, type PluginState, type InstallHqPluginOpts } from '../run/hq-plugin.js';
-import type { SecretLoadResponse, SecretUsage } from './secrets.js';
-
-const SECRET_LOAD_TIMEOUT_MS = 30_000;
-
-export async function buildRunUsage(
-  scriptPath?: string,
-  scriptId?: string,
-): Promise<SecretUsage | undefined> {
-  if (scriptId && !scriptPath) {
-    throw new Error('--script-id requires --script');
-  }
-  if (!scriptPath) {
-    return undefined;
-  }
-  const resolvedPath = path.resolve(scriptPath);
-  return {
-    channel: 'run',
-    script: {
-      scriptId: scriptId ?? resolvedPath,
-      path: resolvedPath,
-      sha256: await computeSha256(resolvedPath),
-      attestationLevel: 'self-asserted-hash',
-    },
-  };
-}
-
-export function registerRunCommand(program: Command): void {
-  program
-    .command('run')
-    .description('Load secrets from .env.schema and run a command with them injected')
-    .option('--company <slug>', 'Company slug (overrides @hqCompany in schema)')
-    .option('--schema <path>', 'Explicit schema path (skips walk-up discovery)')
-    .option('--script <path>', 'Attach local script identity for script-locked secrets')
-    .option('--script-id <id>', 'Stable script identifier approved by policy')
-    .option('--check', 'Resolve schema and validate vars without executing the command')
-    .allowUnknownOption(true)
-    .action(async (opts: {
-      company?: string;
-      schema?: string;
-      script?: string;
-      scriptId?: string;
-      check?: boolean;
-    }) => {
-      try {
-        if (peekHqApiKey() !== undefined) {
-          throw new Error(
-            'HQ_API_KEY is set; `hq run` requires a Cognito session. Unset HQ_API_KEY or use `hq secrets exec`.',
-          );
-        }
-        const dashIndex = process.argv.indexOf('--');
-        const childArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : [];
-
-        if (!opts.check && childArgs.length === 0) {
-          throw new Error('no command specified. Usage: hq run [options] -- <command> [args...]');
-        }
-
-        let schemaPaths: string[];
-        let envLocalPaths: string[];
-        let schemaCompanySlug: string | null;
-
-        if (opts.schema) {
-          const schemaAbs = path.resolve(opts.schema);
-          schemaPaths = [schemaAbs];
-          const localPath = path.join(path.dirname(schemaAbs), '.env.local');
-          envLocalPaths = fs.existsSync(localPath) ? [localPath] : [];
-          const content = fs.readFileSync(schemaAbs, 'utf8');
-          const m = /^# @hqCompany\("([^"]+)"\)/m.exec(content);
-          schemaCompanySlug = m ? m[1] : null;
-        } else {
-          const discovered = discoverSchemas(process.cwd());
-          if (discovered.conflict) {
-            throw new Error(
-              `conflicting @hqCompany slugs: "${discovered.conflict.slugs[0]}" in ${discovered.conflict.paths[0]} vs "${discovered.conflict.slugs[1]}" in ${discovered.conflict.paths[1]}. Use --company <slug> to override.`,
-            );
-          }
-          if (discovered.schemaPaths.length === 0) {
-            throw new Error('no .env.schema found. Create one or use --schema <path>.');
-          }
-          schemaPaths = discovered.schemaPaths;
-          envLocalPaths = discovered.envLocalPaths;
-          schemaCompanySlug = discovered.companySlug;
-        }
-
-        const slug = opts.company ?? schemaCompanySlug;
-        if (!slug) {
-          throw new Error('company slug not set. Add # @hqCompany("slug") to your .env.schema or pass --company <slug>.');
-        }
-
-        const token = await ensureCognitoToken();
-        const uid = await getCompanyUid(token, slug);
-        const usage = await buildRunUsage(opts.script, opts.scriptId);
-
-        const fetchBatch: InstallHqPluginOpts['fetchBatch'] = async (companyUid, names, requestUsage) => {
-          const res = await vaultApiFetch({
-            token,
-            path: `/secrets/${encodeURIComponent(companyUid)}/load`,
-            method: 'POST',
-            body: requestUsage ? { names, usage: requestUsage } : { names },
-            signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
-          });
-          if (!res.ok) {
-            const body = await res.json().catch(() => ({})) as Record<string, unknown>;
-            const message =
-              typeof body.message === 'string'
-                ? body.message
-                : typeof body.error === 'string'
-                  ? body.error
-                  : res.statusText;
-            if (
-              res.status >= 400 &&
-              res.status < 500 &&
-              typeof body.code === 'string'
-            ) {
-              throw new Error(message);
-            }
-            throw new Error(`Failed to batch-load secrets: ${message}`);
-          }
-          return res.json() as Promise<SecretLoadResponse>;
-        };
-
-        const pluginOpts: InstallHqPluginOpts = {
-          companyOverride: opts.company,
-          resolveCompanyUid: async () => uid,
-          usage,
-          fetchBatch,
-        };
-
-        // LAST entry = highest precedence; .env.local files trail .env.schema files so any .env.local beats any schema regardless of depth.
-        const paths = [...schemaPaths, ...envLocalPaths];
-
-        let state!: PluginState;
-        const graph = await internal.loadEnvGraph({
-          entryFilePaths: paths,
-          afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
-        });
-        await prewarmHqSecrets(graph, pluginOpts, state);
-        await graph.resolveEnvValues();
-
-        const schemaErrors = Object.entries(graph.configSchema as Record<string, any>)
-          .filter(([, item]) => (item.errors as unknown[])?.length > 0);
-        if (schemaErrors.length > 0) {
-          const msgs = schemaErrors.flatMap(([k, item]) =>
-            (item.errors as Array<{ message?: string }>).map((e) => `  ${k}: ${e.message ?? String(e)}`),
-          );
-          process.stderr.write(`Error: failed to resolve env vars:\n${msgs.join('\n')}\n`);
-          process.exit(1);
-        }
-
-        const resolvedEnv = graph.getResolvedEnvObject() as Record<string, string>;
-        const varCount = Object.keys(resolvedEnv).length;
-        process.stderr.write(`Loaded ${varCount} env vars from .env.schema (company: ${slug})\n`);
-
-        if (opts.check) {
-          process.exit(0);
-        }
-
-        const [childCmd, ...restArgs] = childArgs;
-        const child = spawn(childCmd, restArgs, {
-          stdio: 'inherit',
-          env: { ...process.env, ...resolvedEnv },
-        });
-
-        child.on('error', (err) => {
-          process.stderr.write(`Error: failed to start command '${childCmd}': ${err.message}\n`);
-          process.exit(1);
-        });
-
-        child.on('close', (code, signal) => {
-          if (signal) {
-            process.kill(process.pid, signal);
-          }
-          process.exit(code ?? 1);
-        });
-      } catch (err) {
-        process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
-        process.exit(1);
-      }
-    });
-}