@indigoai-us/hq-cloud 5.44.0 → 5.46.0

package/src/cli/sync.ts

@@ -382,6 +382,73 @@ export function resolveAutoPruneCap(): number {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 0;
 }
 
+/** Max time to wait on the best-effort new-files notification POST. */
+const NOTIFY_FILE_ADDED_TIMEOUT_MS = 5000;
+
+/**
+ * Best-effort report of the files that were new to this drive during the sync,
+ * so the HQ Sync app can show a persistent cross-session "new files" history.
+ *
+ * POSTs to `${apiUrl}/v1/notify/file-added`, which writes per-recipient
+ * FILE_EVENT rows for the calling user (the one the files are new for). Fully
+ * non-fatal: any error, non-2xx, or timeout is swallowed — the durable signal
+ * is the synced file itself; this is only a notification mirror. Bounded by a
+ * 5s timeout so a hung endpoint can't stall sync completion. No-op when there
+ * are no new files.
+ */
+async function reportNewFilesToNotify(
+  vaultConfig: VaultServiceConfig,
+  companyUid: string,
+  companySlug: string,
+  files: Array<{ path: string; bytes: number; addedBy: string | null }>,
+): Promise<void> {
+  if (files.length === 0) return;
+  try {
+    const token =
+      typeof vaultConfig.authToken === "function"
+        ? await vaultConfig.authToken()
+        : vaultConfig.authToken;
+    const base = vaultConfig.apiUrl.replace(/\/+$/, "");
+    const controller = new AbortController();
+    const timer = setTimeout(
+      () => controller.abort(),
+      NOTIFY_FILE_ADDED_TIMEOUT_MS,
+    );
+    try {
+      await fetch(`${base}/v1/notify/file-added`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          companyUid,
+          companySlug,
+          files: files.map((f) => ({
+            path: f.path,
+            bytes: f.bytes,
+            ...(f.addedBy ? { addedBy: f.addedBy } : {}),
+          })),
+        }),
+        signal: controller.signal,
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch (err) {
+    // Best-effort: never let notification reporting affect the sync result.
+    try {
+      console.error(
+        `[hq-sync] new-files notify report failed (non-fatal): ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    } catch {
+      // swallow — logging must never break sync
+    }
+  }
+}
+
 /**
  * Sync (pull) all allowed files from the entity vault.
  */
@@ -932,6 +999,14 @@ export async function sync(options: SyncOptions): Promise<SyncResult> {
   }
   emit({ type: "new-files", files: enrichedNewFiles });
 
+  // Report new files to the notification service so they persist as a
+  // cross-session "new files" history in the HQ Sync app (POST
+  // /v1/notify/file-added → per-recipient FILE_EVENT rows for THIS user, who is
+  // the one the files are new for). Best-effort and bounded: a failure or a
+  // hung request must never delay or break the sync — the durable signal is the
+  // synced file itself, this is only a notification mirror.
+  await reportNewFilesToNotify(vaultConfig, ctx.uid, ctx.slug, enrichedNewFiles);
+
   // Codex P1 (PR #24 follow-up): scope-gate tombstone candidates with
   // a per-object HEAD before unlinking. `listRemoteFiles` is STS-scoped
   // (guest sessions with `allowedPrefixes`, role downgrade, custom

package/src/index.ts

@@ -146,6 +146,8 @@ export type {
   TelemetryOptInResponse,
   UsageBatch,
   UsageIngestResult,
+  SkillInvocationBatch,
+  SkillInvocationIngestResult,
   // US-004 — browse-vs-sync membership sync-mode + ACL surface
   SyncMode,
   MembershipSyncConfig,
@@ -163,6 +165,20 @@ export type {
   TelemetryClientSurface,
 } from "./telemetry.js";
 
+// Skill-invocation telemetry collector (`/v1/skill-invocations`). Reads the
+// same Claude Code session logs as the token collector but extracts which
+// skill / slash-command was invoked. Independent cursor; same opt-in gate.
+export {
+  collectAndSendSkillTelemetry,
+  extractSkillEvents,
+} from "./skill-telemetry.js";
+export type {
+  CollectSkillTelemetryOptions,
+  CollectSkillTelemetryResult,
+  SkillEvent,
+  SkillTelemetryClientSurface,
+} from "./skill-telemetry.js";
+
 // STS child vending (VLT-8)
 export type {
   TaskAction,

package/src/skill-telemetry.test.ts

@@ -0,0 +1,279 @@
+import { describe, it, expect } from "vitest";
+import { promises as fs } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { extractSkillEvents, collectAndSendSkillTelemetry } from "./skill-telemetry.js";
+import type { SkillInvocationBatch } from "./vault-client.js";
+
+describe("extractSkillEvents", () => {
+  it("extracts a user-typed slash command with args", () => {
+    const row = {
+      type: "user",
+      sessionId: "sess-1",
+      timestamp: "2026-06-03T10:10:07.220Z",
+      cwd: "/home/ec2-user/hq",
+      uuid: "u-1",
+      message: {
+        role: "user",
+        content:
+          "<command-message>personal:worktree</command-message> <command-name>/personal:worktree</command-name> <command-args>pull latest</command-args>",
+      },
+    };
+    const events = extractSkillEvents(row);
+    expect(events).toEqual([
+      {
+        skill: "personal:worktree",
+        source: "typed",
+        sessionId: "sess-1",
+        timestamp: "2026-06-03T10:10:07.220Z",
+        cwd: "/home/ec2-user/hq",
+        uuid: "u-1",
+        hasArgs: true,
+      },
+    ]);
+  });
+
+  it("marks hasArgs false when command-args is absent or empty", () => {
+    const row = {
+      type: "user",
+      message: { role: "user", content: "<command-name>/deploy</command-name>" },
+    };
+    expect(extractSkillEvents(row)[0]).toMatchObject({ skill: "deploy", source: "typed", hasArgs: false });
+  });
+
+  it("extracts a model-invoked Skill tool_use using the block id for dedup", () => {
+    const row = {
+      type: "assistant",
+      sessionId: "sess-2",
+      timestamp: "2026-06-03T14:00:00.000Z",
+      cwd: "/home/ec2-user/hq",
+      uuid: "row-uuid",
+      message: {
+        role: "assistant",
+        content: [
+          { type: "text", text: "ok" },
+          { type: "tool_use", id: "toolu_abc", name: "Skill", input: { skill: "indigo:hello-world" } },
+        ],
+      },
+    };
+    expect(extractSkillEvents(row)).toEqual([
+      {
+        skill: "indigo:hello-world",
+        source: "model",
+        sessionId: "sess-2",
+        timestamp: "2026-06-03T14:00:00.000Z",
+        cwd: "/home/ec2-user/hq",
+        uuid: "toolu_abc",
+        hasArgs: false,
+      },
+    ]);
+  });
+
+  it("sets hasArgs true for a model invocation with args, without capturing the args text", () => {
+    const row = {
+      type: "assistant",
+      message: {
+        role: "assistant",
+        content: [{ type: "tool_use", name: "Skill", input: { skill: "code-review", args: "high" } }],
+      },
+    };
+    const ev = extractSkillEvents(row)[0];
+    expect(ev).toMatchObject({ skill: "code-review", source: "model", hasArgs: true });
+    // Privacy: raw args must never appear on the extracted event.
+    expect(JSON.stringify(ev)).not.toContain("high");
+  });
+
+  it("ignores non-Skill tool_use blocks and non-invocation rows", () => {
+    expect(
+      extractSkillEvents({
+        type: "assistant",
+        message: { role: "assistant", content: [{ type: "tool_use", name: "Bash", input: { command: "ls" } }] },
+      }),
+    ).toEqual([]);
+    expect(extractSkillEvents({ type: "user", message: { content: "just a normal message" } })).toEqual([]);
+    expect(extractSkillEvents(null)).toEqual([]);
+    expect(extractSkillEvents("nope")).toEqual([]);
+  });
+});
+
+describe("collectAndSendSkillTelemetry — hqRoot scoping", () => {
+  function stubClient(captured: SkillInvocationBatch[]) {
+    return {
+      async getTelemetryOptIn() {
+        return { enabled: true, updatedAt: null };
+      },
+      async postSkillInvocations(batch: SkillInvocationBatch) {
+        captured.push(batch);
+        return { ok: true, written: batch.events.length, skipped: [] };
+      },
+    };
+  }
+
+  function row(obj: Record<string, unknown>): string {
+    return JSON.stringify(obj);
+  }
+
+  it("emits only invocations whose cwd equals hqRoot", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
+    const projects = path.join(tmp, "projects");
+    const hqRoot = "/home/ec2-user/hq";
+
+    // Project A — sessions run from the HQ root.
+    const dirA = path.join(projects, "-home-ec2-user-hq");
+    await fs.mkdir(dirA, { recursive: true });
+    await fs.writeFile(
+      path.join(dirA, "a.jsonl"),
+      [
+        row({ type: "user", sessionId: "s1", timestamp: "2026-06-03T10:00:00Z", cwd: hqRoot, uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }),
+        row({ type: "assistant", sessionId: "s1", timestamp: "2026-06-03T10:01:00Z", cwd: hqRoot, message: { role: "assistant", content: [{ type: "tool_use", id: "t1", name: "Skill", input: { skill: "indigo:hello-world" } }] } }),
+      ].join("\n") + "\n",
+      "utf-8",
+    );
+
+    // Project B — a different repo on the same machine. Must be excluded.
+    const dirB = path.join(projects, "-home-ec2-user-other");
+    await fs.mkdir(dirB, { recursive: true });
+    await fs.writeFile(
+      path.join(dirB, "b.jsonl"),
+      row({ type: "user", sessionId: "s2", timestamp: "2026-06-03T10:02:00Z", cwd: "/home/ec2-user/other", uuid: "u2", message: { role: "user", content: "<command-name>/secret-skill</command-name>" } }) + "\n",
+      "utf-8",
+    );
+
+    const captured: SkillInvocationBatch[] = [];
+    const result = await collectAndSendSkillTelemetry({
+      client: stubClient(captured),
+      machineId: "m-test",
+      installerVersion: "test",
+      hqRoot,
+      claudeProjectsRoot: projects,
+      cursorPath: path.join(tmp, "cursor.json"),
+    });
+
+    const skills = captured.flatMap((b) => b.events.map((e) => e.skill));
+    expect(result.eventsSent).toBe(2);
+    expect(skills.sort()).toEqual(["deploy", "indigo:hello-world"]);
+    // The other-repo invocation never leaves the machine.
+    expect(skills).not.toContain("secret-skill");
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("commits the cursor to EOF on a clean run — a rerun re-sends nothing", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
+    const projects = path.join(tmp, "projects");
+    const dir = path.join(projects, "-p");
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(
+      path.join(dir, "s.jsonl"),
+      row({ type: "user", sessionId: "s1", timestamp: "2026-06-04T09:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }) + "\n",
+      "utf-8",
+    );
+    const cursorPath = path.join(tmp, "cursor.json");
+    const captured: SkillInvocationBatch[] = [];
+    const client = stubClient(captured);
+
+    const r1 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, cursorPath });
+    expect(r1.eventsSent).toBe(1);
+    const r2 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, cursorPath });
+    expect(r2.eventsSent).toBe(0); // cursor at EOF → nothing re-sent
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("does NOT advance the cursor when the POST fails — re-sends on the next run", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
+    const projects = path.join(tmp, "projects");
+    const dir = path.join(projects, "-p");
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(
+      path.join(dir, "s.jsonl"),
+      row({ type: "user", sessionId: "s1", timestamp: "2026-06-04T09:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }) + "\n",
+      "utf-8",
+    );
+    const cursorPath = path.join(tmp, "cursor.json");
+    const captured: SkillInvocationBatch[] = [];
+    let failNext = true;
+    const client = {
+      async getTelemetryOptIn() {
+        return { enabled: true, updatedAt: null };
+      },
+      async postSkillInvocations(batch: SkillInvocationBatch) {
+        if (failNext) {
+          failNext = false;
+          throw new Error("network down");
+        }
+        captured.push(batch);
+        return { ok: true, written: batch.events.length, skipped: [] };
+      },
+    };
+
+    const r1 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, cursorPath });
+    expect(r1.eventsSent).toBe(0); // post threw → nothing committed
+    expect(captured).toHaveLength(0);
+
+    const r2 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, cursorPath });
+    expect(r2.eventsSent).toBe(1); // re-scanned from offset 0 and delivered
+    expect(captured.flatMap((b) => b.events.map((e) => e.skill))).toEqual(["deploy"]);
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("picks up only newly-appended events on a later run (incremental offset)", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
+    const projects = path.join(tmp, "projects");
+    const dir = path.join(projects, "-p");
+    await fs.mkdir(dir, { recursive: true });
+    const file = path.join(dir, "s.jsonl");
+    await fs.writeFile(
+      file,
+      row({ type: "user", sessionId: "s1", timestamp: "2026-06-04T09:00:00Z", cwd: "/x", uuid: "u1", message: { role: "user", content: "<command-name>/deploy</command-name>" } }) + "\n",
+      "utf-8",
+    );
+    const cursorPath = path.join(tmp, "cursor.json");
+    const captured: SkillInvocationBatch[] = [];
+    const client = stubClient(captured);
+
+    await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, cursorPath });
+
+    // New invocation appended after the first clean run.
+    await fs.appendFile(
+      file,
+      row({ type: "assistant", sessionId: "s1", timestamp: "2026-06-04T09:05:00Z", cwd: "/x", message: { role: "assistant", content: [{ type: "tool_use", id: "t9", name: "Skill", input: { skill: "land" } }] } }) + "\n",
+      "utf-8",
+    );
+
+    const r2 = await collectAndSendSkillTelemetry({ client, machineId: "m", installerVersion: "t", claudeProjectsRoot: projects, cursorPath });
+    expect(r2.eventsSent).toBe(1);
+    // Only the appended event — not the original — is re-sent.
+    const lastBatch = captured[captured.length - 1];
+    expect(lastBatch.events.map((e) => e.skill)).toEqual(["land"]);
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("captures every project when hqRoot is omitted", async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "skill-tel-"));
+    const projects = path.join(tmp, "projects");
+    const dir = path.join(projects, "-proj");
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(
+      path.join(dir, "c.jsonl"),
+      row({ type: "user", sessionId: "s3", timestamp: "2026-06-03T10:03:00Z", cwd: "/anywhere", uuid: "u3", message: { role: "user", content: "<command-name>/anywhere-skill</command-name>" } }) + "\n",
+      "utf-8",
+    );
+
+    const captured: SkillInvocationBatch[] = [];
+    const result = await collectAndSendSkillTelemetry({
+      client: stubClient(captured),
+      machineId: "m-test",
+      installerVersion: "test",
+      claudeProjectsRoot: projects,
+      cursorPath: path.join(tmp, "cursor.json"),
+    });
+
+    expect(result.eventsSent).toBe(1);
+    expect(captured[0].events[0].skill).toBe("anywhere-skill");
+
+    await fs.rm(tmp, { recursive: true, force: true });
+  });
+});