@indigoai-us/hq-cloud 6.11.9 → 6.11.10

package/src/telemetry.ts

@@ -27,6 +27,11 @@ import { promises as fs } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 
+import {
+  buildRepoCompanyMap,
+  resolveCompanyForCwd,
+  type RepoCompanyMap,
+} from "./company-resolver.js";
 import type {
   TelemetryOptInResponse,
   UsageBatch,
@@ -51,6 +56,15 @@ export interface CollectTelemetryOptions {
   machineId: string;
   /** Version of the wrapping caller (menubar app, CLI, etc.). Reaches CloudWatch metrics as the `installerVersion` dimension. */
   installerVersion: string;
+  /**
+   * HQ root, used to resolve each event's `cwd` → owning repo → owning company
+   * via `<hqRoot>/companies/manifest.yaml` and stamp `companyUid` on the event
+   * (surface-hq-console-telemetry US-002). The manifest is parsed ONCE per run
+   * (see `buildRepoCompanyMap`); the resulting map is reused for every event.
+   * When omitted (or when no repo matches), `companyUid` is left UNSET and the
+   * server treats the event as unattributed/personal.
+   */
+  hqRoot?: string;
   /** Override `~/.claude/projects` for tests. */
   claudeProjectsRoot?: string;
   /** Override `~/.hq/telemetry-cursor.json` for tests. */
@@ -148,12 +162,23 @@ const KEEP_TOP_LEVEL = [
  *      camelCase top-level fields. The original `message` object — which
  *      carries prompt/response text, thinking, and tool data — is dropped.
  *
+ * `companyUid` (US-002): when the caller has resolved the row's `cwd` to an
+ * owning company (`resolveCompanyForCwd`), it passes that `cmp_*` uid here and
+ * it is stamped on the wire row. It is on the server's KEEP allowlist
+ * (`apps/hq-pro/src/vault-service/handlers/usage.ts`). When `companyUid` is
+ * undefined (cwd maps to no company repo) the field is OMITTED — the server
+ * treats absence as unattributed/personal. The reserved value `unattributed`
+ * is never produced (it can only come from a resolved manifest `cmp_*` uid).
+ *
  * Returns `null` when the input isn't an object. Empty results (e.g. a row
  * with no recognised fields) are still returned as `{}` and emitted; the
  * server accepts empty rows and they're useful as a "Claude Code was run at
  * this time" heartbeat.
  */
-export function sanitizeRow(row: unknown): Record<string, unknown> | null {
+export function sanitizeRow(
+  row: unknown,
+  companyUid?: string,
+): Record<string, unknown> | null {
   if (!row || typeof row !== "object" || Array.isArray(row)) return null;
   const obj = row as Record<string, unknown>;
   const out: Record<string, unknown> = {};
@@ -164,6 +189,12 @@ export function sanitizeRow(row: unknown): Record<string, unknown> | null {
     }
   }
 
+  // Stamp the resolved company attribution. Omit when unresolved so the server
+  // reads it as unattributed/personal. Never the reserved `unattributed`.
+  if (companyUid !== undefined) {
+    out.companyUid = companyUid;
+  }
+
   const message = obj.message;
   if (message && typeof message === "object" && !Array.isArray(message)) {
     const m = message as Record<string, unknown>;
@@ -261,6 +292,13 @@ export async function collectAndSendTelemetry(
   const menubarPath = opts.menubarPath ?? path.join(home, ".hq", "menubar.json");
   const log = opts.log ?? (() => {});
 
+  // Company attribution (US-002): parse the manifest ONCE per run and reuse the
+  // repo-path→companyUid map for every event below. No per-event manifest read.
+  // When `hqRoot` is omitted the map is empty → every event stays unattributed.
+  const repoCompanyMap: RepoCompanyMap = opts.hqRoot
+    ? await buildRepoCompanyMap(opts.hqRoot)
+    : { entries: [] };
+
   // 1. Opt-in check (server-authoritative, with local fallback).
   let enabled: boolean;
   let optInSource: CollectTelemetryResult["optInSource"];
@@ -390,7 +428,17 @@ export async function collectAndSendTelemetry(
       } catch {
         continue;
       }
-      const sanitized = sanitizeRow(parsed);
+      // Resolve this row's cwd → owning company (cmp_* uid) before sanitizing,
+      // using the per-run map. Unresolved → undefined → companyUid omitted.
+      const rowCwd =
+        parsed && typeof parsed === "object" && !Array.isArray(parsed)
+          ? (parsed as Record<string, unknown>).cwd
+          : undefined;
+      const companyUid = resolveCompanyForCwd(
+        typeof rowCwd === "string" ? rowCwd : undefined,
+        repoCompanyMap,
+      );
+      const sanitized = sanitizeRow(parsed, companyUid);
       if (!sanitized) continue;
 
       // Cost of appending this row to the current batch: the row's JSON

package/src/vault-client.ts

@@ -393,7 +393,8 @@ export interface UsageBatch {
    * Sanitized event rows. Each row is a plain object containing only the
    * fields in the server's KEEP allowlist (sessionId, timestamp, uuid, cwd,
    * gitBranch, userType, model, inputTokens, outputTokens,
-   * cacheCreationInputTokens, cacheReadInputTokens). Any extra field is
+   * cacheCreationInputTokens, cacheReadInputTokens, and the optional
+   * companyUid edge-attribution field — US-002). Any extra field is
    * rejected by hq-pro with `unexpected-event-field`, so the sanitizer in
    * `./telemetry.ts` is the only thing allowed to produce these.
    */
@@ -416,7 +417,8 @@ export interface SkillInvocationBatch {
   /**
    * Skill-invocation event rows. Each row contains only the fields in the
    * server's KEEP allowlist (skill, source, sessionId, timestamp, uuid, cwd,
-   * hasArgs). Raw argument text is never included — see the privacy note in
+   * hasArgs, and the optional companyUid edge-attribution field — US-002).
+   * Raw argument text is never included — see the privacy note in
    * `./skill-telemetry.ts`. Any extra field is rejected by hq-pro with
    * `unexpected-event-field`, so the extractor in `./skill-telemetry.ts` is the
    * only thing allowed to produce these.