@indigoai-us/hq-cloud 6.14.1 → 6.14.3

package/src/cli/accept.ts

@@ -14,6 +14,7 @@ import {
   VaultPermissionDeniedError,
 } from "../vault-client.js";
 import type { Membership } from "../vault-client.js";
+import { emitCloudTelemetry } from "../telemetry-events.js";
 
 export interface AcceptOptions {
   /** Raw token or magic link (hq://accept/<token>) */
@@ -78,8 +79,26 @@ export async function accept(options: AcceptOptions): Promise<AcceptResult> {
       }
     }
 
+    void emitCloudTelemetry(client, {
+      eventName: "membership_accept",
+      source: "hq-cli",
+      companyUid: membership.companyUid,
+      properties: {
+        role: membership.role,
+        result: "success",
+      },
+    });
+
     return { membership, companySlug };
   } catch (err) {
+    void emitCloudTelemetry(client, {
+      eventName: "membership_accept",
+      source: "hq-cli",
+      properties: {
+        result: "failure",
+        errorCode: classifyAcceptError(err),
+      },
+    });
     if (err instanceof VaultAuthError) {
       throw new Error("Authentication failed — run `hq auth` to refresh your session");
     }
@@ -95,3 +114,11 @@ export async function accept(options: AcceptOptions): Promise<AcceptResult> {
     throw err;
   }
 }
+
+function classifyAcceptError(err: unknown): string {
+  if (err instanceof VaultAuthError) return "auth";
+  if (err instanceof VaultConflictError) return "conflict";
+  if (err instanceof VaultNotFoundError) return "not_found";
+  if (err instanceof VaultPermissionDeniedError) return "permission";
+  return "error";
+}

package/src/cli/invite.ts

@@ -14,6 +14,7 @@ import {
   VaultConflictError,
 } from "../vault-client.js";
 import type { MembershipRole, Membership } from "../vault-client.js";
+import { emitCloudTelemetry } from "../telemetry-events.js";
 
 export interface InviteOptions {
   /** Target — email address or person slug/uid */
@@ -83,6 +84,17 @@ export async function invite(options: InviteOptions): Promise<InviteResult> {
     });
 
     const magicLink = `hq://accept/${result.inviteToken}`;
+    void emitCloudTelemetry(client, {
+      eventName: "membership_invite",
+      source: "hq-cli",
+      companyUid,
+      properties: {
+        role,
+        result: "success",
+        targetType: isEmail ? "email" : "person",
+        allowedPrefixCount: allowedPrefixes?.length ?? 0,
+      },
+    });
 
     return {
       inviteToken: result.inviteToken,
@@ -90,6 +102,18 @@ export async function invite(options: InviteOptions): Promise<InviteResult> {
       membership: result.membership,
     };
   } catch (err) {
+    void emitCloudTelemetry(client, {
+      eventName: "membership_invite",
+      source: "hq-cli",
+      companyUid,
+      properties: {
+        role,
+        result: "failure",
+        errorCode: classifyInviteError(err),
+        targetType: isEmail ? "email" : "person",
+        allowedPrefixCount: allowedPrefixes?.length ?? 0,
+      },
+    });
     if (err instanceof VaultAuthError) {
       throw new Error("Authentication failed — run `hq auth` to refresh your session");
     }
@@ -103,6 +127,13 @@ export async function invite(options: InviteOptions): Promise<InviteResult> {
   }
 }
 
+function classifyInviteError(err: unknown): string {
+  if (err instanceof VaultAuthError) return "auth";
+  if (err instanceof VaultPermissionDeniedError) return "permission";
+  if (err instanceof VaultConflictError) return "conflict";
+  return "error";
+}
+
 /**
  * List pending invites for a company.
  */

package/src/cli/promote.ts

@@ -13,6 +13,7 @@ import {
   VaultConflictError,
 } from "../vault-client.js";
 import type { MembershipRole, Membership } from "../vault-client.js";
+import { emitCloudTelemetry } from "../telemetry-events.js";
 
 export interface PromoteOptions {
   /** Person slug or UID of the member to promote */
@@ -66,8 +67,30 @@ export async function promote(options: PromoteOptions): Promise<PromoteResult> {
       companyUid,
     });
 
+    void emitCloudTelemetry(client, {
+      eventName: "membership_promote",
+      source: "hq-cli",
+      companyUid,
+      properties: {
+        role: newRole,
+        result: "success",
+        allowedPrefixCount: allowedPrefixes?.length ?? 0,
+      },
+    });
+
     return { membership };
   } catch (err) {
+    void emitCloudTelemetry(client, {
+      eventName: "membership_promote",
+      source: "hq-cli",
+      companyUid,
+      properties: {
+        role: newRole,
+        result: "failure",
+        errorCode: classifyPromoteError(err),
+        allowedPrefixCount: allowedPrefixes?.length ?? 0,
+      },
+    });
     if (err instanceof VaultAuthError) {
       throw new Error("Authentication failed — run `hq auth` to refresh your session");
     }
@@ -84,6 +107,14 @@ export async function promote(options: PromoteOptions): Promise<PromoteResult> {
   }
 }
 
+function classifyPromoteError(err: unknown): string {
+  if (err instanceof VaultAuthError) return "auth";
+  if (err instanceof VaultPermissionDeniedError) return "permission";
+  if (err instanceof VaultNotFoundError) return "not_found";
+  if (err instanceof VaultConflictError) return "conflict";
+  return "error";
+}
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------

package/src/cli/reindex.test.ts

@@ -389,17 +389,46 @@ describe("reindex", () => {
     expect(fs.readFileSync(path.join(link, "note.md"), "utf-8")).toBe("owned by personal\n");
   });
 
-  // ── operation lock (mutual exclusion with sync/rescue) ──────────────────
+  // ── operation lock: reindex uses a SEPARATE scope from sync/rescue ──────
+
+  // Regression for feedback_ed98d810 (the "hq reindex indefinite hang"): when
+  // a watch-mode hq-sync-runner holds the per-root "operation" lock for its
+  // whole lifetime, a shared lock starved `hq reindex` forever. reindex now
+  // takes its own "reindex" scope, so it must run to completion even while the
+  // sync/watch "operation" lock is held by a LIVE holder.
+  it("completes while the sync/watch operation lock is held (no starvation)", () => {
+    // Simulate the long-lived watch runner holding the "operation"-scope lock.
+    // pid = this process → the lock probes it as ALIVE (a live same-PID holder
+    // is treated as busy, never reclaimed), so it is a genuine live holder.
+    const syncLock = lockPathFor(root); // default "operation" scope
+    fs.mkdirSync(path.dirname(syncLock), { recursive: true });
+    fs.writeFileSync(
+      syncLock,
+      JSON.stringify({
+        pid: process.pid,
+        command: "sync",
+        startedAt: new Date(0).toISOString(),
+        hqRoot: root,
+      }),
+    );
+    // Even with a zero-wait bound (never block), reindex acquires its OWN scope
+    // and finishes — proving the operation lock no longer gates it.
+    const { status } = reindex({ repoRoot: root, lockTimeoutSec: 0 });
+    expect(status).toBe(0);
+    expect(fs.existsSync(path.join(root, ".claude/skills"))).toBe(true);
+    // The sync/watch holder is untouched.
+    expect(fs.existsSync(syncLock)).toBe(true);
+  });
 
-  it("refuses (OPERATION_LOCKED_EXIT) when another op holds this root's lock (lockTimeoutSec:0)", () => {
-    // A live holder in another process (pid 1) → with lockTimeoutSec:0 reindex
-    // refuses immediately and does no work. (The new default is to WAIT; the
-    // wait-then-acquire path is covered in operation-lock.test.ts.)
-    const lp = lockPathFor(root);
+  it("refuses (OPERATION_LOCKED_EXIT) when another reindex holds the reindex-scope lock (lockTimeoutSec:0)", () => {
+    // reindex-vs-reindex is still mutually exclusive. A live holder on the
+    // "reindex" scope → with lockTimeoutSec:0 reindex refuses immediately and
+    // does no work. (The wait-then-acquire path is in operation-lock.test.ts.)
+    const lp = lockPathFor(root, "reindex");
     fs.mkdirSync(path.dirname(lp), { recursive: true });
     fs.writeFileSync(
       lp,
-      JSON.stringify({ pid: 1, command: "sync", startedAt: new Date(0).toISOString(), hqRoot: root }),
+      JSON.stringify({ pid: 1, command: "reindex", startedAt: new Date(0).toISOString(), hqRoot: root }),
     );
     const before = fs.existsSync(path.join(root, ".claude/skills"));
     const { status } = reindex({ repoRoot: root, lockTimeoutSec: 0 });
@@ -408,22 +437,24 @@ describe("reindex", () => {
     expect(fs.existsSync(path.join(root, ".claude/skills"))).toBe(before);
   });
 
-  it("skipLock bypasses the lock (internal sync/rescue caller path)", () => {
-    const lp = lockPathFor(root);
+  it("skipLock bypasses the reindex lock (internal sync/rescue caller path)", () => {
+    const lp = lockPathFor(root, "reindex");
     fs.mkdirSync(path.dirname(lp), { recursive: true });
     fs.writeFileSync(
       lp,
-      JSON.stringify({ pid: 1, command: "sync", startedAt: new Date(0).toISOString(), hqRoot: root }),
+      JSON.stringify({ pid: 1, command: "reindex", startedAt: new Date(0).toISOString(), hqRoot: root }),
     );
-    // Even with a live holder on record, the internal caller (which already
-    // holds the lock) runs to completion.
+    // Even with a live reindex holder on record, the internal caller (which
+    // serializes reindex itself at the tail of a pass) runs to completion.
     const { status } = reindex({ repoRoot: root, skipLock: true });
     expect(status).toBe(0);
     expect(fs.existsSync(path.join(root, ".claude/skills"))).toBe(true);
   });
 
-  it("releases the lock after a normal run (no leftover lock file)", () => {
+  it("releases the reindex-scope lock after a normal run (no leftover lock file)", () => {
     reindex({ repoRoot: root });
+    expect(fs.existsSync(lockPathFor(root, "reindex"))).toBe(false);
+    // ...and never created the sync/rescue "operation" lock.
     expect(fs.existsSync(lockPathFor(root))).toBe(false);
   });
 
@@ -526,4 +557,73 @@ describe("reindex", () => {
       fs.lstatSync(path.join(root, ".claude/skills/core:demo/SKILL.md")).isSymbolicLink(),
     ).toBe(true);
   });
+
+  // --- session-log capture into workspace/.session-logs ---------------------
+  describe("session-log capture", () => {
+    let claudeConfigDir: string;
+    // Claude Code encodes the project cwd into its projects-dir name by
+    // replacing every non-alphanumeric char with '-'; mirror that here.
+    const slugFor = (p: string): string => p.replace(/[^a-zA-Z0-9]/g, "-");
+
+    beforeEach(() => {
+      claudeConfigDir = fs.mkdtempSync(path.join(os.tmpdir(), "ms-claude-"));
+      process.env.CLAUDE_CONFIG_DIR = claudeConfigDir;
+    });
+
+    afterEach(() => {
+      fs.rmSync(claudeConfigDir, { recursive: true, force: true });
+      delete process.env.CLAUDE_CONFIG_DIR;
+    });
+
+    function seedProjectLogs(): string {
+      const projDir = path.join(claudeConfigDir, "projects", slugFor(root));
+      fs.mkdirSync(path.join(projDir, "tool-results"), { recursive: true });
+      fs.writeFileSync(path.join(projDir, "session.jsonl"), "line-1\n");
+      fs.writeFileSync(path.join(projDir, "tool-results", "r.txt"), "result\n");
+      return projDir;
+    }
+
+    it("copies all files and folders from the projects dir into workspace/.session-logs", () => {
+      seedProjectLogs();
+
+      expect(reindex({ repoRoot: root }).status).toBe(0);
+
+      const dest = path.join(root, "workspace", ".session-logs");
+      expect(fs.readFileSync(path.join(dest, "session.jsonl"), "utf8")).toBe("line-1\n");
+      expect(fs.readFileSync(path.join(dest, "tool-results", "r.txt"), "utf8")).toBe("result\n");
+    });
+
+    it("overwrites an existing dest file with the newer source copy", () => {
+      seedProjectLogs();
+      const dest = path.join(root, "workspace", ".session-logs");
+      fs.mkdirSync(dest, { recursive: true });
+      fs.writeFileSync(path.join(dest, "session.jsonl"), "STALE\n");
+
+      expect(reindex({ repoRoot: root }).status).toBe(0);
+
+      expect(fs.readFileSync(path.join(dest, "session.jsonl"), "utf8")).toBe("line-1\n");
+    });
+
+    it("never deletes dest entries that have no source counterpart", () => {
+      seedProjectLogs();
+      const dest = path.join(root, "workspace", ".session-logs");
+      fs.mkdirSync(path.join(dest, "old-run"), { recursive: true });
+      fs.writeFileSync(path.join(dest, "old-run", "keep.jsonl"), "keep\n");
+      fs.writeFileSync(path.join(dest, "orphan.txt"), "orphan\n");
+
+      expect(reindex({ repoRoot: root }).status).toBe(0);
+
+      // Source content is present...
+      expect(fs.existsSync(path.join(dest, "session.jsonl"))).toBe(true);
+      // ...and the dest-only entries survived (no prune).
+      expect(fs.readFileSync(path.join(dest, "old-run", "keep.jsonl"), "utf8")).toBe("keep\n");
+      expect(fs.readFileSync(path.join(dest, "orphan.txt"), "utf8")).toBe("orphan\n");
+    });
+
+    it("no-ops (still exit 0) when there is no projects dir for this root", () => {
+      // No seedProjectLogs() → the source dir doesn't exist.
+      expect(reindex({ repoRoot: root }).status).toBe(0);
+      expect(fs.existsSync(path.join(root, "workspace", ".session-logs"))).toBe(false);
+    });
+  });
 });

package/src/cli/reindex.ts

@@ -2,8 +2,9 @@
  * hq reindex — surfaces namespaced skills as Claude Code skill wrappers under
  * .claude/skills/<ns>:<skill>/ (one symlink per source file), mirrors
  * personal/{knowledge,policies,workers,settings}/<entry> into core/<type>/,
- * prunes orphan wrappers + legacy command symlinks, and regenerates the
- * workers registry.
+ * prunes orphan wrappers + legacy command symlinks, captures this root's Claude
+ * Code session logs into workspace/.session-logs, and regenerates the workers
+ * registry.
  *
  * The logic historically lived in a bundled bash script (scripts/reindex.sh)
  * that this module exec'd via `bash`. It is now implemented natively in
@@ -16,6 +17,7 @@
  */
 import { spawnSync } from "child_process";
 import * as fs from "fs";
+import * as os from "os";
 import * as path from "path";
 import {
   acquireOperationLock,
@@ -25,29 +27,45 @@ import {
   OPERATION_LOCK_UNWRITABLE_EXIT,
   type LockHandle,
 } from "../operation-lock.js";
+import {
+  emitCloudTelemetry,
+  type CloudTelemetryClient,
+  type TelemetryClaims,
+} from "../telemetry-events.js";
 
 export interface ReindexOptions {
   /** HQ root to operate on. Defaults to process.cwd(). */
   repoRoot?: string;
   /**
-   * Skip the per-root operation lock. Internal callers (`sync()` / `rescue()`)
-   * already hold the lock for this root and pass `true` so reindex doesn't try
-   * to re-acquire it and refuse against their own live PID. Standalone callers
-   * (`hq reindex`, the reindex hook) leave it falsy so reindex is mutually
-   * exclusive with a running sync/rescue.
+   * Skip reindex's own per-root "reindex"-scope lock. Internal callers
+   * (`sync()` / `rescue()`) run reindex inline at the tail of a pass they
+   * already serialize, and pass `true` so a standalone `hq reindex` holding the
+   * reindex lock never blocks the sync/rescue tail (reindex is idempotent and
+   * re-run every pass, so a benign overlap self-heals). Standalone callers
+   * (`hq reindex`, the reindex hook) leave it falsy so concurrent reindexes are
+   * mutually exclusive.
    */
   skipLock?: boolean;
   /**
-   * Bounded wait (seconds) for the per-root operation lock when a sync/rescue
-   * is already running. `0` → refuse immediately; omitted → inherit
+   * Bounded wait (seconds) for the per-root "reindex"-scope lock when another
+   * reindex is already running. `0` → refuse immediately; omitted → inherit
    * `HQ_OP_LOCK_TIMEOUT` / infinite wait. Ignored when `skipLock` is set.
    *
-   * NB: standalone `hq reindex` waits by default, which is what a human running
-   * it wants. The hq-core reindex HOOK (Stop / PostToolUse) should set a small
-   * `HQ_OP_LOCK_TIMEOUT` (or `0`) so a hook fired mid-sync never blocks the
-   * interactive agent indefinitely.
+   * NB: reindex uses a lock scope SEPARATE from sync/rescue's "operation" lock,
+   * so a long-lived watch-mode sync-runner (which holds the operation lock for
+   * its whole lifetime) can never starve a standalone `hq reindex`
+   * (feedback_ed98d810). Standalone `hq reindex` waits by default, which is what
+   * a human running it wants; the hq-core reindex HOOK (Stop / PostToolUse)
+   * should set a small `HQ_OP_LOCK_TIMEOUT` (or `0`) so a hook fired while
+   * another reindex runs never blocks the interactive agent indefinitely.
    */
   lockTimeoutSec?: number;
+  /** Optional hq-pro ACTION telemetry sink. Omitted in tests/standalone hooks. */
+  telemetryClient?: CloudTelemetryClient | null;
+  telemetryClaims?: TelemetryClaims | null;
+  telemetrySessionId?: string;
+  telemetryCompanyUid?: string;
+  changedCount?: number;
 }
 
 export interface ReindexResult {
@@ -181,6 +199,46 @@ function safeSymlink(target: string, linkPath: string, label: string): boolean {
   }
 }
 
+// Copy every file/folder under Claude Code's session-log directory for this HQ
+// root (`<claude-config>/projects/<encoded-root>`) into
+// `workspace/.session-logs`, so the raw session transcripts are captured inside
+// the HQ tree (where sync/search can see them) on each reindex.
+//
+// Contract (per the feature request):
+//   - copies ALL files and folders from the projects dir into the dest,
+//   - OVERWRITES existing dest files (force), and
+//   - NEVER deletes dest entries that lack a source counterpart — this is a
+//     one-way overlay, not a mirror, so anything already parked in
+//     workspace/.session-logs survives even after Claude Code rotates or prunes
+//     its own projects dir.
+//
+// Best-effort: any failure warns to stderr and is swallowed so it can never
+// fail the reindex. `<claude-config>` honors CLAUDE_CONFIG_DIR, else ~/.claude.
+function copySessionLogs(root: string): void {
+  // Claude Code names a project's log dir by replacing every non-alphanumeric
+  // character in the project's cwd with '-' (e.g. /home/ec2-user/hq ->
+  // -home-ec2-user-hq). Re-derive that slug so we target THIS root's logs.
+  const slug = root.replace(/[^a-zA-Z0-9]/g, "-");
+  const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+  const src = path.join(claudeConfigDir, "projects", slug);
+  if (!isDir(src)) return; // no session logs for this root yet — nothing to do
+
+  const dest = path.join(root, "workspace", ".session-logs");
+  if (!safeMkdir(dest, "workspace/.session-logs directory")) return;
+
+  try {
+    // recursive: copy the whole tree; force: overwrite existing dest files.
+    // cpSync copies src INTO dest and never removes dest-only entries — exactly
+    // the "overwrite, but don't delete extras" contract we want.
+    fs.cpSync(src, dest, { recursive: true, force: true });
+  } catch (err) {
+    warn(
+      `reindex: could not copy session logs from '${src}' to '${dest}' ` +
+        `(${(err as NodeJS.ErrnoException).code ?? "error"}: ${(err as Error).message}); skipping.`,
+    );
+  }
+}
+
 // --- legacy `.claude/commands/<ns>/<skill>.md` symlink matcher --------------
 // Mirrors the bash `case` patterns; `*` matches any chars (including `/`).
 function isLegacyCommandTarget(t: string): boolean {
@@ -202,23 +260,32 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
   const rawRoot = opts.repoRoot ?? process.cwd();
   if (!isDir(rawRoot)) {
     warn(`reindex: REPO_ROOT '${rawRoot}' is not a directory`);
-    return { status: 1 };
+    const result = { status: 1 };
+    emitReindexTelemetry(opts, result, "not_attempted");
+    return result;
   }
   const root = path.resolve(rawRoot);
 
-  // Acquire the per-root operation lock unless an internal caller (sync/rescue,
-  // which already hold it) opted out. A live holder → refuse fast with the
-  // holder's command + PID. The whole body runs inside the try so the lock is
-  // released on every exit path (the process-level signal/exit hooks are the
-  // crash backstop).
+  // Acquire the per-root "reindex"-scope lock unless an internal caller
+  // (sync/rescue) opted out. This scope is SEPARATE from sync/rescue's
+  // "operation" lock, so a long-lived watch-mode sync-runner holding the
+  // operation lock never starves us (feedback_ed98d810) — we only contend with
+  // other reindexes. A live holder → refuse fast with the holder's command +
+  // PID. The whole body runs inside the try so the lock is released on every
+  // exit path (the process-level signal/exit hooks are the crash backstop).
   let opLock: LockHandle | null = null;
   if (!opts.skipLock) {
     try {
-      opLock = acquireOperationLock(root, "reindex", { timeoutSec: opts.lockTimeoutSec });
+      opLock = acquireOperationLock(root, "reindex", {
+        scope: "reindex",
+        timeoutSec: opts.lockTimeoutSec,
+      });
     } catch (err) {
       if (err instanceof OperationLockedError) {
         warn(err.message);
-        return { status: OPERATION_LOCKED_EXIT };
+        const result = { status: OPERATION_LOCKED_EXIT };
+        emitReindexTelemetry(opts, result, "locked");
+        return result;
       }
       if (err instanceof OperationLockUnwritableError) {
         // The lock dir isn't writable (e.g. macOS EPERM / Linux EACCES on a
@@ -227,7 +294,9 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
         // and exit cleanly instead of crashing with a raw `EPERM ... open`
         // (HQ-CLI-2).
         warn(err.message);
-        return { status: OPERATION_LOCK_UNWRITABLE_EXIT };
+        const result = { status: OPERATION_LOCK_UNWRITABLE_EXIT };
+        emitReindexTelemetry(opts, result, "unwritable");
+        return result;
       }
       throw err;
     }
@@ -522,6 +591,11 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
     }
   }
 
+  // --- Session-log capture --------------------------------------------------
+  // Overlay this root's Claude Code session logs into workspace/.session-logs
+  // (copy-all, overwrite, never-prune). Best-effort; never fails the reindex.
+  copySessionLogs(root);
+
   // --- Workers registry regeneration ----------------------------------------
   // Source of truth: each worker.yaml. The registry is a derived index — the
   // generator (when present in the operated-on tree) keeps it in sync.
@@ -548,8 +622,34 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
     );
   }
 
-  return { status: 0 };
+  const result = { status: 0 };
+  emitReindexTelemetry(opts, result, opts.skipLock ? "skipped" : "acquired");
+  return result;
   } finally {
     opLock?.release();
   }
 }
+
+function emitReindexTelemetry(
+  opts: ReindexOptions,
+  result: ReindexResult,
+  lockResult: string,
+): void {
+  void emitCloudTelemetry(
+    opts.telemetryClient,
+    {
+      eventName: "reindex_run",
+      source: "hq-reindex",
+      ...(opts.telemetryCompanyUid ? { companyUid: opts.telemetryCompanyUid } : {}),
+      ...(opts.telemetrySessionId ? { sessionId: opts.telemetrySessionId } : {}),
+      properties: {
+        result: result.status === 0 ? "completed" : "failed",
+        statusCode: result.status,
+        lockResult,
+        changedCount: opts.changedCount ?? 0,
+        skipLockState: opts.skipLock === true ? "skipped" : "acquired",
+      },
+    },
+    { claims: opts.telemetryClaims },
+  );
+}