ccqa 0.12.0 → 0.13.0

package/dist/bin/ccqa.mjs

@@ -3199,6 +3199,44 @@ function resolveProjectOrThrow(project, cwd) {
 */
 const hubUrlOption = ["--hub-url <url>", "ccqa hub base URL (or CCQA_HUB_URL)."];
 const hubTokenOption = ["--hub-token <token>", "ccqa hub bearer token (or CCQA_HUB_TOKEN)."];
+const hubHeaderOption = [
+	"--hub-header <header>",
+	"Extra header sent with every hub request, as \"key:value\" (or CCQA_HUB_HEADER). Repeatable. For infra that gates the hub behind a header check (e.g. a load balancer bypass rule).",
+	collectHubHeader,
+	[]
+];
+/** commander `--hub-header` accumulator: collects repeated flags into an array. */
+function collectHubHeader(value, previous) {
+	return [...previous, value];
+}
+/**
+* Parse `"key:value"` entries (from `--hub-header`, repeatable) into a
+* headers map. The value may itself contain `:` (e.g. a URL), so only the
+* first colon is treated as the separator. Throws on an entry with no colon.
+*/
+function parseHubHeaders(entries) {
+	const headers = {};
+	for (const entry of entries) {
+		const i = entry.indexOf(":");
+		if (i < 0) throw new Error(`invalid --hub-header (expected "key:value"): ${entry}`);
+		const key = entry.slice(0, i).trim();
+		const value = entry.slice(i + 1).trim();
+		if (!key) throw new Error(`invalid --hub-header (expected "key:value"): ${entry}`);
+		headers[key] = value;
+	}
+	return headers;
+}
+/**
+* Resolve custom hub headers from flags, falling back to `CCQA_HUB_HEADER`
+* (a single `"key:value"` entry) when no `--hub-header` flag was given.
+* CI setups typically pass exactly one gateway header via env; `--hub-header`
+* is repeatable for the (rarer) local/multi-header case.
+*/
+function resolveHubHeaders(hubHeader) {
+	if (hubHeader && hubHeader.length > 0) return parseHubHeaders(hubHeader);
+	const envHeader = process.env.CCQA_HUB_HEADER;
+	if (envHeader) return parseHubHeaders([envHeader]);
+}
 /** Thrown by `requireHubClient` when the URL and/or token can't be resolved from flags/env. */
 var HubConnectionError = class extends Error {
 	constructor(message) {
@@ -3215,9 +3253,11 @@ function resolveHubClient(opts) {
 	const baseUrl = opts.hubUrl ?? process.env.CCQA_HUB_URL;
 	const token = opts.hubToken ?? process.env.CCQA_HUB_TOKEN;
 	if (!baseUrl || !token) return null;
+	const headers = resolveHubHeaders(opts.hubHeader);
 	return createHubClient({
 		baseUrl: baseUrl.replace(/\/+$/, ""),
-		token
+		token,
+		...headers ? { headers } : {}
 	});
 }
 /** Same as `resolveHubClient`, but throws `HubConnectionError` instead of returning `null`. */
@@ -3286,7 +3326,7 @@ function addProfileOption(command) {
 * options so help text and behaviour don't drift.
 */
 function addHubOptions(command) {
-	return command.option(...hubUrlOption).option(...hubTokenOption);
+	return command.option(...hubUrlOption).option(...hubTokenOption).option(...hubHeaderOption);
 }
 /**
 * CLI wrapper around `resolveProfileEnv`: on failure, print the error and
@@ -5218,7 +5258,8 @@ async function executeRun(targets, opts) {
 				project: projectForProfile,
 				cwd,
 				hubUrl: opts.hubUrl,
-				hubToken: opts.hubToken
+				hubToken: opts.hubToken,
+				hubHeader: opts.hubHeader
 			});
 		} else await resolveProfileEnv({
 			profile: void 0,
@@ -5236,6 +5277,7 @@ async function executeRun(targets, opts) {
 		hubCtx = resolveHubContext({
 			hubUrl: opts.hubUrl,
 			hubToken: opts.hubToken,
+			hubHeader: opts.hubHeader,
 			project: opts.project,
 			cwd
 		});
@@ -8597,7 +8639,8 @@ const recordCommand = addHubOptions(addProfileOption(addLanguageOption(new Comma
 		project,
 		cwd: cwdForProfile,
 		hubUrl: opts.hubUrl,
-		hubToken: opts.hubToken
+		hubToken: opts.hubToken,
+		hubHeader: opts.hubHeader
 	});
 	else await applyProfileFromOption({
 		profile: void 0,
@@ -8606,7 +8649,8 @@ const recordCommand = addHubOptions(addProfileOption(addLanguageOption(new Comma
 	});
 	const hubClientForTrace = resolveHubClient({
 		hubUrl: opts.hubUrl,
-		hubToken: opts.hubToken
+		hubToken: opts.hubToken,
+		hubHeader: opts.hubHeader
 	});
 	const hubContext = hubClientForTrace && project ? {
 		hub: hubClientForTrace,
@@ -9325,7 +9369,7 @@ Return the spec keys that might be affected by any of the new files. Conservativ
 //#endregion
 //#region src/cli/drift.ts
 const DEFAULT_CONCURRENCY = 3;
-const driftCommand = addLanguageOption(new Command("drift").argument("[feature/spec]", "Optional spec id. If omitted, every spec under .ccqa/features/ is checked.").description("Standalone spec ↔ codebase static audit. Use for PR checks where the browser isn't run. For run-time audit with a structured report, see `ccqa run --report`.").option("--format <fmt>", "Output format: text | json | github", "text").option("--severity <level>", "Exit non-zero on this severity or higher: warn | error", "error").option("--concurrency <n>", `Parallel spec checks (default: ${DEFAULT_CONCURRENCY})`).option("-m, --model <name>", "Claude model alias ('sonnet'|'opus'|'haiku') or full ID. Overrides CCQA_MODEL.").option("--cwd <path>", "Working directory used as both the .ccqa root and the codebase Claude reads. Useful for monorepos. Defaults to process.cwd().").option("--changed", "Restrict drift checks to specs whose relatedPaths intersect the git diff against --base (or, in CI, $GITHUB_BASE_REF, else origin/main). New files are routed to specs via a single lightweight Claude call.").option("--base <ref>", "Base ref to diff against when --changed is set. Defaults to $GITHUB_BASE_REF (CI) or origin/main.").option("--push", "Push the drift result to a ccqa hub as a run (kind: drift).").option("--project <name>", "Logical project name for the pushed run. Defaults to the current directory's name.").option(...hubUrlOption).option(...hubTokenOption)).action(async (specPath, opts) => {
+const driftCommand = addLanguageOption(new Command("drift").argument("[feature/spec]", "Optional spec id. If omitted, every spec under .ccqa/features/ is checked.").description("Standalone spec ↔ codebase static audit. Use for PR checks where the browser isn't run. For run-time audit with a structured report, see `ccqa run --report`.").option("--format <fmt>", "Output format: text | json | github", "text").option("--severity <level>", "Exit non-zero on this severity or higher: warn | error", "error").option("--concurrency <n>", `Parallel spec checks (default: ${DEFAULT_CONCURRENCY})`).option("-m, --model <name>", "Claude model alias ('sonnet'|'opus'|'haiku') or full ID. Overrides CCQA_MODEL.").option("--cwd <path>", "Working directory used as both the .ccqa root and the codebase Claude reads. Useful for monorepos. Defaults to process.cwd().").option("--changed", "Restrict drift checks to specs whose relatedPaths intersect the git diff against --base (or, in CI, $GITHUB_BASE_REF, else origin/main). New files are routed to specs via a single lightweight Claude call.").option("--base <ref>", "Base ref to diff against when --changed is set. Defaults to $GITHUB_BASE_REF (CI) or origin/main.").option("--push", "Push the drift result to a ccqa hub as a run (kind: drift).").option("--project <name>", "Logical project name for the pushed run. Defaults to the current directory's name.").option(...hubUrlOption).option(...hubTokenOption).option(...hubHeaderOption)).action(async (specPath, opts) => {
 	const format = parseFormat(opts.format);
 	const threshold = parseSeverity(opts.severity);
 	const concurrency = parseConcurrency(opts.concurrency);
@@ -11597,7 +11641,7 @@ const CSS = `
      order decides). */
   .chip.kind-chip { color: var(--violet); background: var(--violet-bg); border-color: var(--violet-border); font-family: var(--font); margin-left: 6px; }
   .chip.drift-count-chip { color: var(--amber); background: var(--amber-bg); border-color: var(--amber-border); margin-left: 6px; }
-  .chip.drift-errors-chip { color: var(--fail); background: var(--fail-bg); border-color: var(--fail-border); }
+  .chip.drift-errors-chip { color: var(--fail); background: var(--fail-bg); border-color: var(--fail-border); margin-left: 6px; }
   .drift-meta-box { display: flex; flex-direction: column; gap: 4px; }
   .drift-meta-chips { display: flex; gap: 6px; }
   .specs { display: inline-flex; align-items: center; gap: 9px; }

package/dist/hub-client/index.d.mts

@@ -181,6 +181,12 @@ type LabelsExport = z.infer<typeof LabelsExportSchema>;
 interface HubClientOptions {
   baseUrl: string;
   token: string;
+  /**
+   * Extra headers sent on every request, ahead of any per-call headers and
+   * the `Authorization` header (e.g. an infra gateway/ALB bypass header in
+   * CI — never overrides `Authorization`).
+   */
+  headers?: Record<string, string>;
   /** Override for testing; defaults to the global `fetch`. */
   fetchImpl?: typeof fetch;
 }

package/dist/hub-client/index.mjs

@@ -51,6 +51,7 @@ function createHubClient(opts) {
 					...init,
 					signal,
 					headers: {
+						...opts.headers,
 						...init.headers,
 						Authorization: `Bearer ${opts.token}`
 					}

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {