@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/commands/team-sync.ts

@@ -1,628 +0,0 @@
-/**
- * hq team-sync — pull latest team content with entitlement refresh (US-006)
- *
- * For each companies/{slug}/ directory that has a team.json:
- * 1. Re-authenticate if token is expired (Cognito → device code flow)
- * 2. Fetch current entitlements from API and update sparse checkout if changed
- * 3. Configure git credentials for the pull
- * 4. Git pull latest content
- * 5. Report what changed (new, updated, removed files)
- * 6. Gracefully handle conflicts (warn, don't force overwrite)
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-import { execSync } from 'child_process';
-import { Command } from 'commander';
-import chalk from 'chalk';
-import simpleGit from 'simple-git';
-import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
-import { ensureCognitoToken } from '../utils/cognito-session.js';
-
-// ─── Types ──────────────────────────────────────────────────────────────────
-
-interface TeamMetadata {
-  team_id: string;
-  team_name: string;
-  team_slug: string;
-  joined_at: string;
-}
-
-interface TeamEntitlement {
-  pack_slug: string;
-  paths: string[];
-}
-
-interface RepoConfig {
-  repo_url: string;
-  git_credentials: {
-    username: string;
-    password: string;
-  };
-  default_branch: string;
-}
-
-interface TeamSyncResult {
-  slug: string;
-  teamName: string;
-  success: boolean;
-  action: 'synced' | 'up-to-date' | 'conflict' | 'error';
-  newFiles: string[];
-  updatedFiles: string[];
-  removedFiles: string[];
-  entitlementsChanged: boolean;
-  message?: string;
-}
-
-// ─── API helpers ────────────────────────────────────────────────────────────
-
-const API_BASE = 'https://example.com/api';
-
-async function apiGet<T>(urlPath: string, token: string): Promise<T> {
-  const res = await fetch(`${API_BASE}${urlPath}`, {
-    method: 'GET',
-    headers: {
-      Accept: 'application/json',
-      Authorization: `Bearer ${token}`,
-    },
-    signal: AbortSignal.timeout(15_000),
-  });
-
-  if (!res.ok) {
-    const text = await res.text().catch(() => '');
-    throw new Error(`API ${urlPath} failed (${res.status}): ${text}`);
-  }
-
-  return (await res.json()) as T;
-}
-
-async function fetchTeamEntitlements(
-  teamId: string,
-  token: string
-): Promise<TeamEntitlement[]> {
-  const data = await apiGet<{ entitlements: TeamEntitlement[] }>(
-    `/teams/${encodeURIComponent(teamId)}/entitlements/mine`,
-    token
-  );
-  return data.entitlements ?? [];
-}
-
-async function fetchRepoConfig(
-  teamId: string,
-  token: string
-): Promise<RepoConfig> {
-  return apiGet<RepoConfig>(
-    `/teams/${encodeURIComponent(teamId)}/repo-config`,
-    token
-  );
-}
-
-// ─── Sparse checkout helpers ────────────────────────────────────────────────
-
-/**
- * Read the current sparse checkout paths from the repo.
- * Returns an empty array if sparse checkout is not configured.
- */
-function getCurrentSparseCheckoutPaths(repoDir: string): string[] {
-  try {
-    const output = execSync('git sparse-checkout list', {
-      cwd: repoDir,
-      stdio: 'pipe',
-      encoding: 'utf-8',
-    });
-    return output
-      .split('\n')
-      .map((l) => l.trim())
-      .filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Update sparse checkout paths. Returns true if paths changed.
- */
-function updateSparseCheckout(
-  repoDir: string,
-  newPaths: string[]
-): boolean {
-  const current = getCurrentSparseCheckoutPaths(repoDir);
-  const currentSet = new Set(current);
-  const newSet = new Set(newPaths);
-
-  // Check if paths are identical
-  if (
-    currentSet.size === newSet.size &&
-    [...currentSet].every((p) => newSet.has(p))
-  ) {
-    return false;
-  }
-
-  // Update sparse checkout
-  if (newPaths.length > 0) {
-    const pathList = newPaths.join(' ');
-    execSync(`git sparse-checkout set ${pathList}`, {
-      cwd: repoDir,
-      stdio: 'pipe',
-    });
-  }
-
-  return true;
-}
-
-// ─── Git credential helper ──────────────────────────────────────────────────
-
-/**
- * Configure git credentials for a pull operation.
- * Uses the credential helper to inject the token for HTTPS auth.
- * Credentials are set per-repo (not global) and cleared after pull.
- */
-function configureGitCredentials(
-  repoDir: string,
-  repoConfig: RepoConfig
-): void {
-  const { username, password } = repoConfig.git_credentials;
-  // Set up a one-shot credential helper that provides the token
-  // This avoids writing secrets to disk or the git config permanently
-  const credentialHelper = `!f() { echo "username=${username}"; echo "password=${password}"; }; f`;
-  execSync(
-    `git config credential.helper '${credentialHelper}'`,
-    { cwd: repoDir, stdio: 'pipe' }
-  );
-}
-
-/**
- * Clear temporary git credentials after pull.
- */
-function clearGitCredentials(repoDir: string): void {
-  try {
-    execSync('git config --unset credential.helper', {
-      cwd: repoDir,
-      stdio: 'pipe',
-    });
-  } catch {
-    // Ignore — may already be unset
-  }
-}
-
-// ─── File diff tracking ────────────────────────────────────────────────────
-
-/**
- * Get the list of tracked files currently checked out.
- */
-function getTrackedFiles(repoDir: string): Set<string> {
-  try {
-    const output = execSync('git ls-files', {
-      cwd: repoDir,
-      stdio: 'pipe',
-      encoding: 'utf-8',
-    });
-    return new Set(
-      output
-        .split('\n')
-        .map((l) => l.trim())
-        .filter(Boolean)
-    );
-  } catch {
-    return new Set();
-  }
-}
-
-// ─── Team sync core ─────────────────────────────────────────────────────────
-
-/**
- * Discover all team directories — directories with a team.json file.
- */
-function discoverTeamDirs(hqRoot: string): { dir: string; meta: TeamMetadata }[] {
-  const companiesDir = path.join(hqRoot, 'companies');
-  if (!fs.existsSync(companiesDir)) {
-    return [];
-  }
-
-  const results: { dir: string; meta: TeamMetadata }[] = [];
-
-  for (const entry of fs.readdirSync(companiesDir, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-
-    const teamJsonPath = path.join(companiesDir, entry.name, 'team.json');
-    if (!fs.existsSync(teamJsonPath)) continue;
-
-    try {
-      const raw = fs.readFileSync(teamJsonPath, 'utf-8');
-      const meta = JSON.parse(raw) as TeamMetadata;
-
-      if (meta.team_id && meta.team_slug) {
-        results.push({
-          dir: path.join(companiesDir, entry.name),
-          meta,
-        });
-      }
-    } catch {
-      // Skip malformed team.json
-    }
-  }
-
-  return results;
-}
-
-/**
- * Sync a single team directory:
- * 1. Refresh entitlements → update sparse checkout
- * 2. Configure credentials → git pull
- * 3. Report changes
- */
-async function syncTeam(
-  teamDir: string,
-  meta: TeamMetadata,
-  accessToken: string
-): Promise<TeamSyncResult> {
-  const result: TeamSyncResult = {
-    slug: meta.team_slug,
-    teamName: meta.team_name,
-    success: false,
-    action: 'error',
-    newFiles: [],
-    updatedFiles: [],
-    removedFiles: [],
-    entitlementsChanged: false,
-  };
-
-  const git = simpleGit(teamDir);
-
-  // Check if this is actually a git repo
-  try {
-    const isRepo = await git.checkIsRepo();
-    if (!isRepo) {
-      result.message = 'Not a git repository — skipping (run team setup first)';
-      return result;
-    }
-  } catch {
-    result.message = 'Not a git repository — skipping (run team setup first)';
-    return result;
-  }
-
-  // 1. Fetch current entitlements and update sparse checkout
-  try {
-    const entitlements = await fetchTeamEntitlements(
-      meta.team_id,
-      accessToken
-    );
-    const entitledPaths = entitlements.flatMap((e) => e.paths);
-
-    if (entitledPaths.length > 0) {
-      result.entitlementsChanged = updateSparseCheckout(teamDir, entitledPaths);
-      if (result.entitlementsChanged) {
-        console.log(
-          chalk.yellow(`    Entitlements changed — sparse checkout updated`)
-        );
-      }
-    }
-  } catch (err) {
-    console.log(
-      chalk.yellow(
-        `    Warning: could not refresh entitlements: ${err instanceof Error ? err.message : 'Unknown error'}`
-      )
-    );
-    console.log(chalk.yellow(`    Continuing with existing sparse checkout...`));
-  }
-
-  // 2. Snapshot files before pull
-  const filesBefore = getTrackedFiles(teamDir);
-
-  // 3. Check for local modifications (conflict detection)
-  try {
-    const status = await git.status();
-    if (status.modified.length > 0 || status.staged.length > 0) {
-      console.log(
-        chalk.yellow(
-          `    Warning: ${status.modified.length + status.staged.length} locally modified file(s) detected`
-        )
-      );
-      for (const f of [...status.modified, ...status.staged].slice(0, 10)) {
-        console.log(chalk.yellow(`      - ${f}`));
-      }
-      if (status.modified.length + status.staged.length > 10) {
-        console.log(
-          chalk.yellow(
-            `      ... and ${status.modified.length + status.staged.length - 10} more`
-          )
-        );
-      }
-    }
-  } catch {
-    // Status check failed — continue anyway
-  }
-
-  // 4. Configure credentials and pull
-  let repoConfig: RepoConfig;
-  try {
-    repoConfig = await fetchRepoConfig(
-      meta.team_id,
-      accessToken
-    );
-  } catch (err) {
-    result.message = `Failed to fetch repo credentials: ${err instanceof Error ? err.message : 'Unknown error'}`;
-    return result;
-  }
-
-  try {
-    configureGitCredentials(teamDir, repoConfig);
-
-    // Fetch first
-    await git.fetch(['origin']);
-
-    // Attempt pull with --ff-only to avoid merge conflicts
-    try {
-      const pullResult = await git.pull('origin', repoConfig.default_branch, [
-        '--ff-only',
-      ]);
-
-      if (
-        pullResult.summary.changes === 0 &&
-        pullResult.summary.insertions === 0 &&
-        pullResult.summary.deletions === 0
-      ) {
-        result.success = true;
-        result.action = 'up-to-date';
-        return result;
-      }
-    } catch (pullErr) {
-      const errMsg =
-        pullErr instanceof Error ? pullErr.message : String(pullErr);
-
-      if (
-        errMsg.includes('Not possible to fast-forward') ||
-        errMsg.includes('CONFLICT') ||
-        errMsg.includes('diverged')
-      ) {
-        result.action = 'conflict';
-        result.message =
-          'Local changes conflict with remote. ' +
-          'Resolve manually or stash local changes and retry:\n' +
-          `      cd ${teamDir}\n` +
-          '      git stash\n' +
-          '      hq team-sync\n' +
-          '      git stash pop';
-        return result;
-      }
-
-      // Re-throw unexpected errors
-      throw pullErr;
-    }
-
-    // 5. Snapshot files after pull and compute diff
-    const filesAfter = getTrackedFiles(teamDir);
-
-    for (const f of filesAfter) {
-      if (!filesBefore.has(f)) {
-        result.newFiles.push(f);
-      }
-    }
-
-    for (const f of filesBefore) {
-      if (!filesAfter.has(f)) {
-        result.removedFiles.push(f);
-      }
-    }
-
-    // Approximate updated files: files that existed before and after
-    // (git pull output would be more precise but this is sufficient)
-    // We count files that are in both sets as potentially updated
-    // The actual change count comes from the pull summary
-    result.updatedFiles = []; // Tracked via pull summary above
-
-    result.success = true;
-    result.action = 'synced';
-  } catch (err) {
-    result.message = `Pull failed: ${err instanceof Error ? err.message : 'Unknown error'}`;
-  } finally {
-    clearGitCredentials(teamDir);
-  }
-
-  return result;
-}
-
-// ─── Command registration ───────────────────────────────────────────────────
-
-export function registerTeamSyncCommand(program: Command): void {
-  program
-    .command('team-sync')
-    .description('Pull latest team content for all joined teams')
-    .option('--team <slug>', 'Sync only a specific team by slug')
-    .option('--dry-run', 'Show what would be synced without making changes')
-    .action(
-      async (options: { team?: string; dryRun?: boolean }) => {
-        try {
-          const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
-
-          // 1. Discover team directories
-          let teamDirs = discoverTeamDirs(hqRoot);
-
-          if (teamDirs.length === 0) {
-            console.log(
-              chalk.yellow(
-                'No team directories found. Join a team first with: npx create-hq'
-              )
-            );
-            return;
-          }
-
-          // Filter to specific team if requested
-          if (options.team) {
-            teamDirs = teamDirs.filter(
-              (t) => t.meta.team_slug === options.team
-            );
-            if (teamDirs.length === 0) {
-              console.log(
-                chalk.red(
-                  `Team "${options.team}" not found. Available teams:`
-                )
-              );
-              for (const t of discoverTeamDirs(hqRoot)) {
-                console.log(`  - ${t.meta.team_slug} (${t.meta.team_name})`);
-              }
-              process.exit(1);
-            }
-          }
-
-          // 2. Get valid auth token (handles refresh / re-auth prompt)
-          let authToken: string;
-          try {
-            authToken = await ensureCognitoToken();
-          } catch (err) {
-            console.error(
-              chalk.red(
-                `Authentication required: ${err instanceof Error ? err.message : 'Unknown error'}`
-              )
-            );
-            console.error(
-              chalk.yellow("Run 'hq login' to authenticate, then retry.")
-            );
-            process.exit(1);
-          }
-
-          // 3. Sync each team
-          console.log(
-            chalk.bold(
-              `\nSyncing ${teamDirs.length} team${teamDirs.length === 1 ? '' : 's'}...\n`
-            )
-          );
-
-          const results: TeamSyncResult[] = [];
-
-          for (const { dir, meta } of teamDirs) {
-            console.log(chalk.cyan(`  [${meta.team_name}]`));
-
-            if (options.dryRun) {
-              console.log(chalk.dim(`    Would sync: ${dir}`));
-              console.log(
-                chalk.dim(`    Team ID: ${meta.team_id}`)
-              );
-              console.log();
-              continue;
-            }
-
-            const result = await syncTeam(dir, meta, authToken);
-            results.push(result);
-
-            // Print result
-            switch (result.action) {
-              case 'synced': {
-                const parts: string[] = [];
-                if (result.newFiles.length > 0)
-                  parts.push(
-                    chalk.green(`+${result.newFiles.length} new`)
-                  );
-                if (result.removedFiles.length > 0)
-                  parts.push(
-                    chalk.red(`-${result.removedFiles.length} removed`)
-                  );
-                if (result.entitlementsChanged)
-                  parts.push(chalk.yellow('entitlements updated'));
-
-                const detail =
-                  parts.length > 0 ? ` (${parts.join(', ')})` : '';
-                console.log(
-                  chalk.green(`    ✓ Synced${detail}`)
-                );
-
-                // Show new files
-                for (const f of result.newFiles.slice(0, 5)) {
-                  console.log(chalk.green(`      + ${f}`));
-                }
-                if (result.newFiles.length > 5) {
-                  console.log(
-                    chalk.dim(
-                      `      ... and ${result.newFiles.length - 5} more`
-                    )
-                  );
-                }
-
-                // Show removed files
-                for (const f of result.removedFiles.slice(0, 5)) {
-                  console.log(chalk.red(`      - ${f}`));
-                }
-                if (result.removedFiles.length > 5) {
-                  console.log(
-                    chalk.dim(
-                      `      ... and ${result.removedFiles.length - 5} more`
-                    )
-                  );
-                }
-                break;
-              }
-
-              case 'up-to-date':
-                console.log(chalk.dim(`    ✓ Already up to date`));
-                break;
-
-              case 'conflict':
-                console.log(
-                  chalk.yellow(`    ⚠ Conflict detected`)
-                );
-                if (result.message) {
-                  console.log(chalk.yellow(`    ${result.message}`));
-                }
-                break;
-
-              case 'error':
-                console.log(
-                  chalk.red(
-                    `    ✗ Error: ${result.message ?? 'Unknown error'}`
-                  )
-                );
-                break;
-            }
-
-            console.log();
-          }
-
-          if (options.dryRun) {
-            console.log(chalk.dim('Dry run complete — no changes made.'));
-            return;
-          }
-
-          // 4. Summary
-          const synced = results.filter(
-            (r) => r.action === 'synced'
-          ).length;
-          const upToDate = results.filter(
-            (r) => r.action === 'up-to-date'
-          ).length;
-          const conflicts = results.filter(
-            (r) => r.action === 'conflict'
-          ).length;
-          const errors = results.filter(
-            (r) => r.action === 'error'
-          ).length;
-
-          const summaryParts: string[] = [];
-          if (synced > 0) summaryParts.push(`${synced} synced`);
-          if (upToDate > 0)
-            summaryParts.push(`${upToDate} up to date`);
-          if (conflicts > 0)
-            summaryParts.push(
-              chalk.yellow(`${conflicts} conflict${conflicts > 1 ? 's' : ''}`)
-            );
-          if (errors > 0)
-            summaryParts.push(
-              chalk.red(`${errors} error${errors > 1 ? 's' : ''}`)
-            );
-
-          console.log(
-            chalk.bold(`Done: ${summaryParts.join(', ')}`)
-          );
-
-          if (conflicts > 0 || errors > 0) {
-            process.exit(1);
-          }
-        } catch (error) {
-          console.error(
-            chalk.red('Error:'),
-            error instanceof Error ? error.message : error
-          );
-          process.exit(1);
-        }
-      }
-    );
-}

package/src/commands/update.ts

@@ -1,71 +0,0 @@
-/**
- * hq modules update command (US-008)
- * Updates lock for specific module
- */
-
-import * as path from 'path';
-import { Command } from 'commander';
-import { findHqRoot, readManifest, readLock, writeLock, getModulesDir } from '../utils/manifest.js';
-import { fetchRepo, pullRepo, getCurrentCommit, isRepo } from '../utils/git.js';
-
-export function registerUpdateCommand(program: Command): void {
-  program
-    .command('update [module-name]')
-    .description('Update lock for a specific module (or all if no name given)')
-    .action(async (moduleName?: string) => {
-      try {
-        const hqRoot = findHqRoot();
-        const manifest = readManifest(hqRoot);
-
-        if (!manifest || manifest.modules.length === 0) {
-          console.log('No modules in manifest.');
-          return;
-        }
-
-        let lock = readLock(hqRoot);
-        if (!lock) {
-          lock = { version: '1', locked: {} };
-        }
-
-        const modulesDir = getModulesDir(hqRoot);
-        const modulesToUpdate = moduleName
-          ? manifest.modules.filter(m => m.name === moduleName)
-          : manifest.modules;
-
-        if (moduleName && modulesToUpdate.length === 0) {
-          console.error(`Module "${moduleName}" not found in manifest.`);
-          process.exit(1);
-        }
-
-        for (const module of modulesToUpdate) {
-          const moduleDir = path.join(modulesDir, module.name);
-
-          if (!await isRepo(moduleDir)) {
-            console.log(`  ${module.name}: not installed, skipping`);
-            continue;
-          }
-
-          console.log(`  ${module.name}: fetching...`);
-          await fetchRepo(moduleDir);
-          await pullRepo(moduleDir);
-
-          const commit = await getCurrentCommit(moduleDir);
-          const oldCommit = lock.locked[module.name];
-          lock.locked[module.name] = commit;
-
-          if (oldCommit === commit) {
-            console.log(`  ${module.name}: already up to date @ ${commit.slice(0, 7)}`);
-          } else {
-            console.log(`  ${module.name}: updated ${oldCommit?.slice(0, 7) || 'none'} -> ${commit.slice(0, 7)}`);
-          }
-        }
-
-        writeLock(hqRoot, lock);
-        console.log('\nLock file updated.');
-
-      } catch (error) {
-        console.error('Error:', error instanceof Error ? error.message : error);
-        process.exit(1);
-      }
-    });
-}