@indigoai-us/hq-cli 5.77.14 → 5.79.0

package/src/sentry-before-send.ts

@@ -1,221 +0,0 @@
-// src/sentry-before-send.ts — canonical fleet scrubber
-// Line 1 is per-repo — see "Per-repo `import type` line" table in Step 3.
-// hq-console uses @sentry/nextjs. Consumer steps override to their own SDK.
-import type { ErrorEvent, EventHint } from "@sentry/node";
-
-const SENSITIVE_FIELD_NAMES = new Set([
-  "password", "secret", "apikey", "api_key", "token",
-  // Cognito token-response fields captured as error context.
-  "idtoken", "accesstoken", "refreshtoken",
-]);
-
-// Stored lowercased; membership tested against `name.toLowerCase()`.
-// MUST cover BOTH Auth.js v5 (current in hq-console, pinned to
-// next-auth@5.0.0-beta.25 which resolves @auth/core@0.37.2) AND legacy
-// NextAuth v4 name spaces — covering both is cheap and survives accidental
-// downgrades or mixed-version repos. Grounded against @auth/core@0.37.2's
-// src/lib/utils/cookie.ts (re-ground via `grep -nE
-// '(sessionToken|callbackUrl|csrfToken|pkceCodeVerifier|state|nonce|webauthnChallenge): \{'
-// node_modules/.pnpm/@auth+core@0.37.2/node_modules/@auth/core/src/lib/utils/cookie.ts`
-// — seven matches, one per cookie family): two distinct prefixing patterns
-// coexist there, and the entries below mirror BOTH exactly:
-//   • session-token / callback-url / pkce.code_verifier / state / nonce /
-//     challenge each pair the bare form (HTTP dev, cookiePrefix="") with
-//     the __Secure- form (HTTPS prod, cookiePrefix="__Secure-").
-//   • csrf-token is special: the source explicitly uses __Host- (NOT
-//     __Secure-) under HTTPS for stricter cookie scoping (the csrfToken
-//     entry in @auth/core's cookie.ts is the only one whose name template
-//     uses `__Host-` instead of `${cookiePrefix}`; the comment above it
-//     reads "Default to __Host- for CSRF token for additional protection
-//     if using useSecureCookies"). The set therefore pairs the bare form
-//     with __Host-, and does NOT include __Secure-authjs.csrf-token
-//     because @auth/core never emits that name. The legacy v4 entry mirrors
-//     the same pattern (bare next-auth.csrf-token + __Host-next-auth.csrf-token,
-//     no __Secure- variant).
-// Missing any of the four OAuth-state families (pkce.code_verifier, state,
-// nonce, challenge) ships a cookie-leak in the same class as the v4-only
-// defect Round-4 called out. This set is the single authoritative spec;
-// all of Steps 3/8/9a/12/13 reproduce it identically.
-//
-// MAINTAINER NOTE: Do NOT extend this set by mechanically pairing every
-// cookie with bare + __Secure- + __Host-. The pairing follows the source:
-// session-style cookies use __Secure-; csrf-style cookies use __Host-.
-// New entries added in the future must be grounded against the actual
-// emitter (Auth.js source for v5/v4, vendor docs for Clerk, etc.) rather
-// than copied from the existing pattern.
-const SENSITIVE_COOKIE_NAMES = new Set([
-  // ==== Auth.js v5 (next-auth@5 / @auth/core) ====
-  // Session JWT — bare + __Secure-
-  "authjs.session-token",
-  "__secure-authjs.session-token",
-  // CSRF double-submit token — bare + __Host- ONLY (@auth/core's cookie.ts
-  // csrfToken entry uses __Host-, never __Secure-)
-  "authjs.csrf-token",
-  "__host-authjs.csrf-token",
-  // Post-auth redirect URL — bare + __Secure-
-  "authjs.callback-url",
-  "__secure-authjs.callback-url",
-  // OAuth PKCE verifier — leaking this enables interception of an in-flight
-  // OAuth code exchange.
-  "authjs.pkce.code_verifier",
-  "__secure-authjs.pkce.code_verifier",
-  // OAuth CSRF/replay protection
-  "authjs.state",
-  "__secure-authjs.state",
-  // OpenID Connect nonce — replay protection
-  "authjs.nonce",
-  "__secure-authjs.nonce",
-  // OAuth WebAuthn challenge
-  "authjs.challenge",
-  "__secure-authjs.challenge",
-  // ==== NextAuth v4 legacy names (kept so accidental downgrades /
-  //       mixed-version monorepos don't silently leak). Same prefix
-  //       discipline as v5: csrf-token uses __Host-, others use __Secure-. ====
-  "next-auth.session-token",
-  "__secure-next-auth.session-token",
-  "next-auth.csrf-token",
-  "__host-next-auth.csrf-token",
-  "next-auth.callback-url",
-  "__secure-next-auth.callback-url",
-  "next-auth.pkce.code_verifier",
-  "__secure-next-auth.pkce.code_verifier",
-  "next-auth.state",
-  "__secure-next-auth.state",
-  // ==== Clerk (documented for future; no-op today) ====
-  "__clerk_db_jwt", "__session",
-]);
-
-const REDACTED = "[Filtered]";
-
-const SENSITIVE_HEADER_NAMES = new Set([
-  "authorization", "proxy-authorization",
-  "cookie", "set-cookie",
-  "x-api-key", "x-auth-token", "x-access-token", "x-session-token",
-]);
-
-function scrubHeaders(h?: Record<string, unknown>): Record<string, unknown> | undefined {
-  if (!h) return h;
-  const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(h)) {
-    out[k] = SENSITIVE_HEADER_NAMES.has(k.toLowerCase()) ? REDACTED : v;
-  }
-  return out;
-}
-
-type CookieField = Record<string, unknown> | string | undefined;
-
-function scrubCookies(c: CookieField): CookieField {
-  if (!c) return c;
-  if (typeof c === "string") return REDACTED; // raw Cookie header — wholesale redact
-  const out: Record<string, unknown> = {};
-  for (const [k, v] of Object.entries(c)) {
-    out[k] = SENSITIVE_COOKIE_NAMES.has(k.toLowerCase()) ? REDACTED : v;
-  }
-  return out;
-}
-
-const SENSITIVE_STRING_PATTERNS: RegExp[] = [
-  // kv pairs; `(?:id|access|refresh)[_-]?token` catches Cognito-style free-text
-  // `accessToken=...`, `refreshToken: ...`, `id_token=...` which bare `\btoken` misses.
-  /\b(password|secret|api[_-]?key|(?:id|access|refresh)[_-]?token|token)\s*[:=]\s*[^\s&"'<>]+/gi,
-  /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi,
-  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
-];
-
-function scrubString(s: string): string {
-  let out = s;
-  for (const re of SENSITIVE_STRING_PATTERNS) {
-    out = out.replace(re, (m) => {
-      const sep = m.search(/[:=\s]/);
-      return sep > 0 ? `${m.slice(0, sep + 1)}${REDACTED}` : REDACTED;
-    });
-  }
-  return out;
-}
-
-function scrubQueryString(qs: string): string {
-  try {
-    const params = new URLSearchParams(qs.startsWith("?") ? qs.slice(1) : qs);
-    const out: string[] = [];
-    for (const [k, v] of params) {
-      out.push(`${k}=${SENSITIVE_FIELD_NAMES.has(k.toLowerCase()) ? REDACTED : v}`);
-    }
-    const joined = out.join("&");
-    return qs.startsWith("?") ? `?${joined}` : joined;
-  } catch {
-    return scrubString(qs);
-  }
-}
-
-function scrubFields<T>(value: T, memo: Map<object, unknown> = new Map()): T {
-  if (value === null || typeof value !== "object") return value;
-  const obj = value as unknown as object;
-  // On cycle revisit, return the SAME scrubbed copy built on first visit —
-  // NOT the original. Returning the original would leak fields reachable
-  // only through the cycle (e.g., a.self.token).
-  if (memo.has(obj)) return memo.get(obj) as T;
-
-  if (Array.isArray(value)) {
-    const arr: unknown[] = [];
-    memo.set(obj, arr);
-    for (const v of value) arr.push(scrubFields(v, memo));
-    return arr as unknown as T;
-  }
-
-  const out: Record<string, unknown> = {};
-  memo.set(obj, out);
-  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-    if (SENSITIVE_FIELD_NAMES.has(k.toLowerCase())) {
-      out[k] = REDACTED;
-    } else if (v !== null && typeof v === "object") {
-      out[k] = scrubFields(v, memo);
-    } else if (typeof v === "string") {
-      // SCALAR-STRING DEFENSE-IN-DEPTH. A stringified log line stashed via
-      // setExtra / setContext / setUser can embed `password=...` or a Bearer
-      // token even when the outer key (`note`, `bio`, `log_line`, …) isn't
-      // in SENSITIVE_FIELD_NAMES. Route scalar strings through scrubString so
-      // these don't bypass the scrubber on their way into Sentry.
-      out[k] = scrubString(v);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out as unknown as T;
-}
-
-export function beforeSend(event: ErrorEvent, _hint: EventHint): ErrorEvent | null {
-  if (event.request) {
-    const req = event.request as { headers?: unknown; cookies?: unknown; data?: unknown; query_string?: unknown };
-    event.request = {
-      ...event.request,
-      headers: scrubHeaders(req.headers as Record<string, unknown> | undefined) as typeof event.request.headers,
-      cookies: scrubCookies(req.cookies as CookieField) as typeof event.request.cookies,
-      data: scrubFields(req.data),
-      query_string:
-        typeof req.query_string === "string"
-          ? scrubQueryString(req.query_string)
-          : (req.query_string as typeof event.request.query_string),
-    };
-  }
-  if (typeof event.message === "string") event.message = scrubString(event.message);
-  if (event.exception?.values) {
-    event.exception = {
-      ...event.exception,
-      values: event.exception.values.map((v) => ({
-        ...v,
-        value: typeof v.value === "string" ? scrubString(v.value) : v.value,
-      })),
-    };
-  }
-  if (event.user) event.user = scrubFields(event.user as Record<string, unknown>) as typeof event.user;
-  if (event.breadcrumbs) {
-    event.breadcrumbs = event.breadcrumbs.map((b) => ({
-      ...b,
-      message: typeof b.message === "string" ? scrubString(b.message) : b.message,
-      data: b.data ? scrubFields(b.data) : b.data,
-    }));
-  }
-  if (event.extra) event.extra = scrubFields(event.extra);
-  if (event.contexts) event.contexts = scrubFields(event.contexts);
-  return event;
-}

package/src/sentry-epipe.test.ts

@@ -1,37 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import type { ErrorEvent, EventHint } from "@sentry/node";
-
-// sentry.ts reads BUNDLED_DSN at import time; stub it so the module loads
-// without a real DSN (mirrors sentry.test.ts).
-vi.mock("./sentry-dsn.generated.js", () => ({ BUNDLED_DSN: "" }));
-
-import { epipeAwareBeforeSend } from "./sentry.js";
-
-describe("epipeAwareBeforeSend (HQ-6B)", () => {
-  it("drops an EPIPE crash before it can ship a fatal", () => {
-    const epipe = Object.assign(new Error("write EPIPE"), { code: "EPIPE" });
-    const event = {
-      exception: { values: [{ type: "Error", value: "write EPIPE" }] },
-    } as ErrorEvent;
-    const out = epipeAwareBeforeSend(event, {
-      originalException: epipe,
-    } as EventHint);
-    expect(out).toBeNull();
-  });
-
-  it("forwards a genuine error to the scrubber (still reported)", () => {
-    const err = new Error("boom");
-    const event = { message: "boom" } as ErrorEvent;
-    const out = epipeAwareBeforeSend(event, {
-      originalException: err,
-    } as EventHint);
-    expect(out).not.toBeNull();
-    expect(out?.message).toBe("boom");
-  });
-
-  it("forwards when there is no originalException hint", () => {
-    const event = { message: "no hint" } as ErrorEvent;
-    const out = epipeAwareBeforeSend(event, {} as EventHint);
-    expect(out).not.toBeNull();
-  });
-});

package/src/sentry-release.test.ts

@@ -1,54 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
-
-// `@sentry/node`'s `init` is a non-configurable export, so it can't be spied
-// in place — replace it via importOriginal spread (every OTHER Sentry export
-// stays real, so initSentry's setUser/startSession remain harmless no-ops with
-// no real SDK init). We only need to inspect the options handed to `init`.
-const { initMock } = vi.hoisted(() => ({ initMock: vi.fn() }));
-vi.mock("@sentry/node", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@sentry/node")>();
-  return { ...actual, init: initMock };
-});
-// A DSN must be present for initSentry to reach Sentry.init.
-vi.mock("./sentry-dsn.generated.js", () => ({
-  BUNDLED_DSN: "https://examplePublicKey@o0.ingest.sentry.io/0",
-}));
-
-import { initSentry } from "./sentry.js";
-import { CLI_VERSION } from "./cli-version.js";
-
-const PKG_VERSION = (
-  JSON.parse(
-    readFileSync(
-      path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json"),
-      "utf-8",
-    ),
-  ) as { version: string }
-).version;
-
-describe("initSentry — release tag carries the real CLI version (resolve-by-release)", () => {
-  afterEach(() => {
-    vi.clearAllMocks();
-  });
-
-  // Locks the resolve-by-release path for hq-cli: every event must be stamped
-  // with the REAL package version so Sentry's "resolved in next release" works
-  // and old-version stragglers (the legacy `hq-cli@0.0.0` events from pre-#8
-  // installs) sort as the oldest release and stay suppressed. Regression guard
-  // against ever reverting to the `npm_package_version` 0.0.0 pitfall.
-  it("stamps release = hq-cli@<package.json version>, never the 0.0.0 placeholder", () => {
-    initSentry();
-
-    expect(initMock).toHaveBeenCalledTimes(1);
-    const opts = initMock.mock.calls[0][0] as { release?: string };
-
-    // CLI_VERSION resolves from package.json at runtime (not npm_package_version).
-    expect(CLI_VERSION).toBe(PKG_VERSION);
-    expect(CLI_VERSION).not.toBe("0.0.0");
-    expect(opts.release).toBe(`hq-cli@${PKG_VERSION}`);
-    expect(opts.release).not.toBe("hq-cli@0.0.0");
-  });
-});

package/src/sentry.test.ts

@@ -1,24 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import * as Sentry from "@sentry/node";
-import { initSentry } from "./sentry.js";
-
-vi.mock("./sentry-dsn.generated.js", () => ({ BUNDLED_DSN: "" }));
-
-describe("initSentry — empty BUNDLED_DSN no-op", () => {
-  afterEach(() => {
-    vi.unstubAllEnvs();
-  });
-
-  it("fakeTransport.send is never called after captureException + flush(2000) when no DSN configured", async () => {
-    vi.stubEnv("SENTRY_DSN", "");
-
-    const fakeTransport = { send: vi.fn().mockResolvedValue(undefined) };
-
-    initSentry();
-
-    Sentry.captureException(new Error("no-dsn-should-not-send"));
-    await Sentry.flush(2000);
-
-    expect(fakeTransport.send).not.toHaveBeenCalled();
-  });
-});

package/src/sentry.ts

@@ -1,54 +0,0 @@
-import * as Sentry from "@sentry/node";
-import type { ErrorEvent, EventHint } from "@sentry/node";
-import { BUNDLED_DSN } from "./sentry-dsn.generated.js";
-import { beforeSend } from "./sentry-before-send.js";
-import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
-import { CLI_VERSION } from "./cli-version.js";
-import { getCachedSentryUser } from "./utils/sentry-identity.js";
-import { isEpipe } from "./utils/epipe.js";
-
-/**
- * Drop broken-pipe (EPIPE) crashes before scrubbing/send. A closed downstream
- * reader (`hq … | head`, `source <(hq …)`, a parent that exited) is normal
- * Unix behavior with no user-facing degradation — never a defect to report.
- * This is the path-independent catch-all for HQ-6B: whichever way an EPIPE
- * surfaces (a synchronous throw into the command catch, an async stream
- * 'error', or a write outside the top-level try), it never ships a fatal. The
- * clean-exit handlers in index.ts still keep exit code 0 for the common paths.
- * Consistent with the swallow-EPIPE posture established in #138.
- */
-export function epipeAwareBeforeSend(
-  event: ErrorEvent,
-  hint: EventHint,
-): ErrorEvent | null {
-  if (isEpipe(hint?.originalException)) return null;
-  return beforeSend(event, hint);
-}
-
-export function initSentry(): void {
-  const dsn = BUNDLED_DSN || process.env.SENTRY_DSN;
-  if (!dsn) return;
-  Sentry.init({
-    dsn,
-    // CLI_VERSION reads package.json at runtime; npm_package_version is only
-    // set under `npm run`, so an installed `hq` binary would always report
-    // 0.0.0 and never match the uploaded source maps.
-    release: `hq-cli@${CLI_VERSION}`,
-    environment: process.env.HQ_CLI_ENV ?? "production",
-    initialScope: {
-      tags: { repo: "hq-cli" },
-    },
-    beforeSend: epipeAwareBeforeSend,
-    beforeBreadcrumb,
-  });
-  // Attribute events to the logged-in HQ identity (best-effort; null when not
-  // logged in). A CLI process is one user, so global setUser is correct here.
-  const user = getCachedSentryUser();
-  if (user) Sentry.setUser(user);
-  // Release health: one session per CLI run. Ended + flushed in index.ts's
-  // finally (covers every exit path). A captured error auto-marks the session
-  // "errored", so crash-free numbers per release stay accurate.
-  Sentry.startSession();
-}
-
-export { Sentry };

package/src/strategies/link.ts

@@ -1,62 +0,0 @@
-/**
- * Link Sync Strategy (US-006)
- * Symlinks module paths into HQ tree
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-import type { LegacyModuleDefinition, SyncResult } from '../types.js';
-
-export async function linkSync(
-  module: LegacyModuleDefinition,
-  moduleDir: string,
-  hqRoot: string
-): Promise<SyncResult> {
-  let filesChanged = 0;
-
-  for (const mapping of module.paths) {
-    const srcPath = path.join(moduleDir, mapping.src);
-    const destPath = path.join(hqRoot, mapping.dest);
-
-    // Validate source exists
-    if (!fs.existsSync(srcPath)) {
-      return {
-        module: module.name,
-        success: false,
-        action: 'skipped',
-        message: `Source path not found: ${mapping.src}`,
-      };
-    }
-
-    // Ensure dest parent directory exists
-    const destDir = path.dirname(destPath);
-    if (!fs.existsSync(destDir)) {
-      fs.mkdirSync(destDir, { recursive: true });
-    }
-
-    // Handle existing dest
-    if (fs.existsSync(destPath)) {
-      const stat = fs.lstatSync(destPath);
-      if (stat.isSymbolicLink()) {
-        // Remove existing symlink and recreate
-        fs.unlinkSync(destPath);
-      } else {
-        // Real file exists - warn and skip
-        console.warn(`  Warning: Real file exists at ${mapping.dest}, skipping`);
-        continue;
-      }
-    }
-
-    // Create relative symlink for portability
-    const relativeSrc = path.relative(destDir, srcPath);
-    fs.symlinkSync(relativeSrc, destPath);
-    filesChanged++;
-  }
-
-  return {
-    module: module.name,
-    success: true,
-    action: 'synced',
-    filesChanged,
-  };
-}

package/src/strategies/merge.ts

@@ -1,142 +0,0 @@
-/**
- * Merge Sync Strategy (US-007)
- * Copies files from module into HQ, tracks state for conflict detection
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-import * as crypto from 'crypto';
-import type { LegacyModuleDefinition, SyncResult, SyncState } from '../types.js';
-import { readState, writeState } from '../utils/manifest.js';
-
-function hashFile(filePath: string): string {
-  const content = fs.readFileSync(filePath);
-  return crypto.createHash('sha256').update(content).digest('hex');
-}
-
-function copyRecursive(
-  srcDir: string,
-  destDir: string,
-  state: SyncState,
-  moduleName: string,
-  hqRoot: string,
-  filesChanged: { count: number }
-): void {
-  if (!fs.existsSync(destDir)) {
-    fs.mkdirSync(destDir, { recursive: true });
-  }
-
-  const entries = fs.readdirSync(srcDir, { withFileTypes: true });
-  for (const entry of entries) {
-    const srcPath = path.join(srcDir, entry.name);
-    const destPath = path.join(destDir, entry.name);
-
-    if (entry.isDirectory()) {
-      copyRecursive(srcPath, destPath, state, moduleName, hqRoot, filesChanged);
-    } else {
-      const relativeDest = path.relative(hqRoot, destPath);
-      const newHash = hashFile(srcPath);
-
-      // Check if file exists and has been modified by user
-      if (fs.existsSync(destPath)) {
-        const existingHash = hashFile(destPath);
-        const lastSyncedHash = state.files[relativeDest]?.hash;
-
-        if (lastSyncedHash && existingHash !== lastSyncedHash && existingHash !== newHash) {
-          // User modified the file since last sync - skip (conflict)
-          console.warn(`  Conflict: ${relativeDest} has local changes, skipping`);
-          continue;
-        }
-
-        if (existingHash === newHash) {
-          // File unchanged, skip
-          continue;
-        }
-      }
-
-      // Copy file
-      fs.copyFileSync(srcPath, destPath);
-      filesChanged.count++;
-
-      // Track in state
-      state.files[relativeDest] = {
-        hash: newHash,
-        syncedAt: new Date().toISOString(),
-        fromModule: moduleName,
-      };
-    }
-  }
-}
-
-export async function mergeSync(
-  module: LegacyModuleDefinition,
-  moduleDir: string,
-  hqRoot: string
-): Promise<SyncResult> {
-  let state = readState(hqRoot);
-  if (!state) {
-    state = { version: '1', files: {} };
-  }
-
-  const filesChanged = { count: 0 };
-
-  for (const mapping of module.paths) {
-    const srcPath = path.join(moduleDir, mapping.src);
-    const destPath = path.join(hqRoot, mapping.dest);
-
-    if (!fs.existsSync(srcPath)) {
-      return {
-        module: module.name,
-        success: false,
-        action: 'skipped',
-        message: `Source path not found: ${mapping.src}`,
-      };
-    }
-
-    const srcStat = fs.statSync(srcPath);
-    if (srcStat.isDirectory()) {
-      copyRecursive(srcPath, destPath, state, module.name, hqRoot, filesChanged);
-    } else {
-      // Single file
-      const destDir = path.dirname(destPath);
-      if (!fs.existsSync(destDir)) {
-        fs.mkdirSync(destDir, { recursive: true });
-      }
-
-      const relativeDest = path.relative(hqRoot, destPath);
-      const newHash = hashFile(srcPath);
-
-      if (fs.existsSync(destPath)) {
-        const existingHash = hashFile(destPath);
-        const lastSyncedHash = state.files[relativeDest]?.hash;
-
-        if (lastSyncedHash && existingHash !== lastSyncedHash && existingHash !== newHash) {
-          console.warn(`  Conflict: ${relativeDest} has local changes, skipping`);
-          continue;
-        }
-
-        if (existingHash === newHash) {
-          continue;
-        }
-      }
-
-      fs.copyFileSync(srcPath, destPath);
-      filesChanged.count++;
-
-      state.files[relativeDest] = {
-        hash: newHash,
-        syncedAt: new Date().toISOString(),
-        fromModule: module.name,
-      };
-    }
-  }
-
-  writeState(hqRoot, state);
-
-  return {
-    module: module.name,
-    success: true,
-    action: 'synced',
-    filesChanged: filesChanged.count,
-  };
-}