@indigoai-us/hq-cli 5.77.8 → 5.77.10

package/src/utils/vault-api.test.ts

@@ -1,3 +1,5 @@
+import * as os from 'node:os';
+import * as path from 'node:path';
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 
 vi.mock('../sentry.js', () => ({
@@ -9,6 +11,17 @@ import { getCompanyUid, getEntityUid, resolveCallerPersonUid, vaultApiFetch } fr
 import { isAuthError } from './auth-error.js';
 import { isCompanySelectionError } from './company-selection-error.js';
 import { isExpectedUserError } from './expected-cli-error.js';
+import {
+  _resetForTests,
+  emitPlanLimitNag,
+} from '../lib/plan-limit-nag.js';
+
+function tmpNagStatePath(label: string): string {
+  return path.join(
+    os.tmpdir(),
+    `hq-plan-limit-vault-api-${label}-${process.pid}-${Date.now()}.json`,
+  );
+}
 
 const fetchMock = vi.fn();
 const originalFetch = globalThis.fetch;
@@ -23,10 +36,12 @@ function mockResponse(status: number, body: unknown): Response {
 beforeEach(() => {
   fetchMock.mockReset();
   globalThis.fetch = fetchMock as unknown as typeof fetch;
+  _resetForTests();
 });
 
 afterEach(() => {
   globalThis.fetch = originalFetch;
+  _resetForTests();
 });
 
 describe('resolveCallerPersonUid', () => {
@@ -395,3 +410,127 @@ describe('vaultApiFetch abort signals', () => {
     );
   });
 });
+
+describe('vaultApiFetch plan-limit peek (US-016, no-clone body drain)', () => {
+  it('JSON ok response is still fully readable by the caller after peek', async () => {
+    const payload = { ok: true, items: [1, 2, 3], planLimits: undefined };
+    fetchMock.mockResolvedValueOnce(mockResponse(200, payload));
+
+    const res = await vaultApiFetch({ token: 'tok', path: '/v1/items' });
+    expect(res.ok).toBe(true);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body).toEqual(payload);
+  });
+
+  it('records planLimits payload (observable via emitPlanLimitNag)', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        ok: true,
+        planLimits: {
+          users: { used: 9, limit: 10, over: false },
+        },
+      }),
+    );
+
+    const res = await vaultApiFetch({ token: 'tok', path: '/v1/items' });
+    // Caller can still read the body.
+    await expect(res.json()).resolves.toMatchObject({ ok: true });
+
+    const lines: string[] = [];
+    emitPlanLimitNag({
+      write: (s) => {
+        lines.push(s);
+      },
+      statePath: tmpNagStatePath('recorded'),
+    });
+    expect(lines).toHaveLength(1);
+    expect(lines[0]).toMatch(/HQ free plan/i);
+    expect(lines[0]).toMatch(/users at 9\/10/);
+  });
+
+  it('non-JSON content-type body is not buffered (response returned untouched)', async () => {
+    const original = new Response(new Uint8Array([1, 2, 3, 4]), {
+      status: 200,
+      statusText: 'OK',
+      headers: { 'Content-Type': 'application/octet-stream' },
+    });
+    fetchMock.mockResolvedValueOnce(original);
+
+    const res = await vaultApiFetch({ token: 'tok', path: '/v1/download' });
+    // Same object identity — peek must not re-wrap non-JSON bodies.
+    expect(res).toBe(original);
+    const buf = new Uint8Array(await res.arrayBuffer());
+    expect(Array.from(buf)).toEqual([1, 2, 3, 4]);
+  });
+
+  it('malformed JSON does not throw and body is still readable', async () => {
+    const raw = '{not-valid-json';
+    fetchMock.mockResolvedValueOnce(
+      new Response(raw, {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+
+    let res: Response;
+    await expect(
+      (async () => {
+        res = await vaultApiFetch({ token: 'tok', path: '/v1/broken' });
+        return res;
+      })(),
+    ).resolves.toBeDefined();
+
+    expect(res!.ok).toBe(true);
+    await expect(res!.text()).resolves.toBe(raw);
+
+    // Malformed body must not record plan limits.
+    const lines: string[] = [];
+    emitPlanLimitNag({
+      write: (s) => {
+        lines.push(s);
+      },
+      statePath: tmpNagStatePath('malformed'),
+    });
+    expect(lines).toHaveLength(0);
+  });
+
+  it('non-ok responses are returned untouched', async () => {
+    const original = mockResponse(404, { error: 'not found' });
+    fetchMock.mockResolvedValueOnce(original);
+
+    const res = await vaultApiFetch({ token: 'tok', path: '/v1/missing' });
+    expect(res).toBe(original);
+    expect(res.status).toBe(404);
+    await expect(res.json()).resolves.toEqual({ error: 'not found' });
+  });
+
+  it('accepts application/*+json content-types for peek', async () => {
+    fetchMock.mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          planLimits: { seats: { used: 8, limit: 10, over: false } },
+        }),
+        {
+          status: 200,
+          headers: { 'Content-Type': 'application/vnd.api+json' },
+        },
+      ),
+    );
+
+    const res = await vaultApiFetch({ token: 'tok', path: '/v1/vnd' });
+    await expect(res.json()).resolves.toMatchObject({
+      planLimits: { seats: { used: 8, limit: 10, over: false } },
+    });
+
+    const lines: string[] = [];
+    emitPlanLimitNag({
+      write: (s) => {
+        lines.push(s);
+      },
+      statePath: tmpNagStatePath('vnd'),
+    });
+    expect(lines).toHaveLength(1);
+    expect(lines[0]).toMatch(/seats at 8\/10/);
+  });
+});

package/src/utils/vault-api.ts

@@ -2,6 +2,7 @@ import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
 import { Sentry } from '../sentry.js';
 import { AuthError } from './auth-error.js';
 import { CompanySelectionError } from './company-selection-error.js';
+import { recordPlanLimitStatus } from '../lib/plan-limit-nag.js';
 
 export interface VaultApiOptions {
   token: string;
@@ -12,6 +13,64 @@ export interface VaultApiOptions {
   signal?: AbortSignal;
 }
 
+/**
+ * Best-effort peek of a 2xx JSON body for plan-limit status (US-016).
+ *
+ * For ok JSON responses: read the body ONCE, record planLimits (best-effort),
+ * and return a NEW Response built from the buffered body so callers can still
+ * call .json()/.text()/.arrayBuffer(). Non-JSON and non-ok responses are
+ * returned untouched (streamed binary downloads must never be buffered).
+ *
+ * Never throws. On any error: return the original response if its body has
+ * not been consumed, otherwise the re-wrapped one.
+ *
+ * Why not response.clone()? Cloning tees the undici body stream; when a
+ * caller never consumes the original Response body (many commands only check
+ * response.ok/status), the unused tee branch keeps the connection/handle
+ * referenced and the process (or vitest worker / spawned CLI child) never
+ * exits on Linux CI. Reading once + re-wrapping fully drains the stream.
+ */
+async function peekPlanLimitStatus(response: Response): Promise<Response> {
+  try {
+    if (!response.ok) return response;
+    const ct = response.headers.get('content-type') ?? '';
+    if (!ct.includes('application/json') && !ct.includes('+json')) {
+      return response;
+    }
+
+    let buf: ArrayBuffer;
+    try {
+      buf = await response.arrayBuffer();
+    } catch {
+      // Body may be locked/errored; original is the only thing we can return.
+      return response;
+    }
+
+    try {
+      const text = new TextDecoder().decode(buf);
+      try {
+        recordPlanLimitStatus(JSON.parse(text) as unknown);
+      } catch {
+        // Malformed JSON must be ignored silently.
+      }
+    } catch {
+      // Best-effort record only — still re-wrap so body is readable.
+    }
+
+    // Body was consumed; always return a re-wrapped Response so callers can
+    // still read it (even if parse/record failed).
+    return new Response(buf, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers,
+    });
+  } catch {
+    // Outer safety net: never throw from the peek path. If we never consumed
+    // the body, the original is still usable.
+    return response;
+  }
+}
+
 export async function vaultApiFetch(opts: VaultApiOptions): Promise<Response> {
   const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
   if (opts.query) {
@@ -43,8 +102,9 @@ export async function vaultApiFetch(opts: VaultApiOptions): Promise<Response> {
       level: "warning",
       data: { url: safeUrl, status: response.status },
     });
+    return response;
   }
-  return response;
+  return peekPlanLimitStatus(response);
 }
 
 /**