@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/core-job-remediate-native.js

@@ -0,0 +1,374 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { spawnSync } from "node:child_process";
+import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { registerCoreJobLeaf } from "./core-job-native-utils.js";
+const ASSET = "core/scripts/hq-job-remediate.sh";
+const USAGE = [
+    "hq-job-remediate.sh — bounded self-remediation for Outpost scheduled jobs (US-006).",
+    "",
+    "Allowlist (v1):",
+    "  - Cognito / HQ token refresh via `hq auth refresh` when available",
+    "  - one `hq sync pull` (personal or --company)",
+    "  - single immediate retry for transient infra (signaled via retry_recommended)",
+    "Always-human (never auto-looped):",
+    "  - device re-login (Claude/Codex CLI)",
+    "  - secret share / missing vault grants",
+    "",
+    "Usage:",
+    "  core/scripts/hq-job-remediate.sh --failure-class <class> [--job-id <id>] \\",
+    "    [--company <slug>] [--hq-root <dir>]",
+    "",
+    "Env / overrides (tests):",
+    "  HQ_ROOT, HQ_JOB_REMEDIATE_AUTH_REFRESH_CMD, HQ_JOB_REMEDIATE_SYNC_PULL_CMD",
+    "  HQ_JOB_REMEDIATE_DRY=1 — print plan only; do not execute side effects",
+    "",
+    "stdout: JSON {failure_class, attempted, actions[], retry_recommended, always_human, next_action, notes}",
+    "Exit: 0 always on successful classify/plan (even if nothing attempted); 2 usage.",
+    "",
+    "set -euo pipefail",
+    "",
+].join("\n");
+function defaultCommandExists(command, env) {
+    if (command.includes(path.sep)) {
+        try {
+            fs.accessSync(command, fs.constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    for (const directory of (env.PATH ?? "").split(path.delimiter)) {
+        if (!directory)
+            continue;
+        try {
+            fs.accessSync(path.join(directory, command), fs.constants.X_OK);
+            return true;
+        }
+        catch { /* Continue PATH lookup. */ }
+    }
+    return false;
+}
+function defaultRun(command, args, options) {
+    // The shell redirects both streams to the append-only log (or /dev/null). No
+    // timeout is set, matching its direct command invocation exactly.
+    let fd;
+    try {
+        fd = fs.openSync(options.logPath || os.devNull, "a");
+    }
+    catch {
+        // Bash reports failed redirection as a nonzero action; remediation still
+        // emits its classification JSON and exit status 0.
+        return 1;
+    }
+    try {
+        const result = spawnSync(command, args, {
+            cwd: options.cwd,
+            env: options.env,
+            stdio: ["ignore", fd, fd],
+        });
+        if (result.error) {
+            fs.writeSync(fd, `${result.error.message}\n`);
+            return 127;
+        }
+        return result.status ?? 0;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function defaultJobRemediateDependencies(env = process.env, cwd = process.cwd()) {
+    return {
+        env,
+        cwd,
+        readFile: (file) => fs.readFileSync(file, "utf8"),
+        commandExists: (command) => defaultCommandExists(command, env),
+        run: defaultRun,
+        stdout: (text) => { process.stdout.write(text); },
+        stderr: (text) => { process.stderr.write(text); },
+    };
+}
+function parseArguments(argv, deps) {
+    const values = { hqRoot: deps.env.HQ_ROOT ?? "", failureClass: "", jobId: "", company: "", dryRun: false };
+    const aliases = {
+        "--hq-root": "hqRoot", "--failure-class": "failureClass", "--job-id": "jobId", "--company": "company",
+    };
+    for (let index = 0; index < argv.length;) {
+        const flag = argv[index];
+        if (flag === "-h" || flag === "--help") {
+            deps.stdout(USAGE);
+            return 0;
+        }
+        if (flag === "--dry-run") {
+            values.dryRun = true;
+            index += 1;
+            continue;
+        }
+        if (flag === "--")
+            break;
+        const key = aliases[flag];
+        if (key) {
+            const value = argv[index + 1] ?? "";
+            if ((key === "hqRoot" || key === "failureClass") && !value) {
+                deps.stderr(`hq-job-remediate: --${key === "hqRoot" ? "hq-root" : "failure-class"} requires ${key === "hqRoot" ? "a directory" : "a value"}\n`);
+                return 2;
+            }
+            values[key] = value;
+            index += 2;
+            continue;
+        }
+        if (flag.startsWith("-")) {
+            deps.stderr(`hq-job-remediate: unknown option: ${flag}\n`);
+            return 2;
+        }
+        deps.stderr(`hq-job-remediate: unexpected argument: ${flag}\n`);
+        return 2;
+    }
+    if (!values.failureClass) {
+        deps.stderr("hq-job-remediate: usage: hq-job-remediate.sh --failure-class <auth|secrets|timeout|agent_error|infra>\n");
+        return 2;
+    }
+    if (!["auth", "secrets", "timeout", "agent_error", "infra"].includes(values.failureClass)) {
+        deps.stderr(`hq-job-remediate: unknown failure_class: ${values.failureClass} (want auth|secrets|timeout|agent_error|infra)\n`);
+        return 2;
+    }
+    if (values.company && values.company !== "null" && !/^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$/.test(values.company)) {
+        deps.stderr(`hq-job-remediate: invalid --company slug '${values.company}' (want lowercase kebab/underscore)\n`);
+        return 2;
+    }
+    return values;
+}
+function canUseLiveRootForArguments(argv) {
+    const parsed = parseArguments(argv, {
+        env: {},
+        stdout: () => undefined,
+        stderr: () => undefined,
+    });
+    return typeof parsed !== "number";
+}
+function globRegex(segment) {
+    let pattern = "^";
+    for (let index = 0; index < segment.length; index += 1) {
+        const char = segment[index];
+        if (char === "\\" && index + 1 < segment.length) {
+            pattern += segment[++index].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        }
+        else if (char === "*")
+            pattern += ".*";
+        else if (char === "?")
+            pattern += ".";
+        else if (char === "[") {
+            const end = segment.indexOf("]", index + 1);
+            if (end < 0)
+                pattern += "\\[";
+            else {
+                let body = segment.slice(index + 1, end);
+                if (body.startsWith("!"))
+                    body = `^${body.slice(1)}`;
+                pattern += `[${body.replace(/\\/g, "")} ]`.replace(" ]", "]");
+                index = end;
+            }
+        }
+        else
+            pattern += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp(`${pattern}$`);
+}
+/** Bash's unquoted array assignment splits on IFS, then expands pathname globs. */
+function splitOverrideCommand(command, cwd) {
+    const words = command.split(/[ \t\n]+/).filter(Boolean);
+    const expanded = [];
+    for (const word of words) {
+        if (!/[?*[]/.test(word)) {
+            expanded.push(word);
+            continue;
+        }
+        const absolute = path.isAbsolute(word);
+        const parts = word.split(path.sep);
+        let prefixes = [absolute ? path.sep : ""];
+        for (const part of parts) {
+            if (!part)
+                continue;
+            if (!/[?*[]/.test(part)) {
+                prefixes = prefixes.map((prefix) => path.join(prefix || cwd, part));
+                continue;
+            }
+            const matcher = globRegex(part);
+            const next = [];
+            for (const prefix of prefixes) {
+                const directory = prefix || cwd;
+                let names;
+                try {
+                    names = fs.readdirSync(directory);
+                }
+                catch {
+                    continue;
+                }
+                for (const name of names) {
+                    if (!part.startsWith(".") && name.startsWith("."))
+                        continue;
+                    if (matcher.test(name))
+                        next.push(path.join(directory, name));
+                }
+            }
+            prefixes = next;
+            if (!prefixes.length)
+                break;
+        }
+        if (!prefixes.length)
+            expanded.push(word);
+        else
+            expanded.push(...prefixes.map((entry) => absolute ? entry : path.relative(cwd, entry) || "."));
+    }
+    return expanded;
+}
+const UNSAFE_OVERRIDE = /[;|&$`()<>]/;
+export function runJobRemediate(argv, options = {}) {
+    const deps = {
+        ...defaultJobRemediateDependencies(options.dependencies?.env ?? process.env, options.dependencies?.cwd ?? process.cwd()),
+        ...options.dependencies,
+    };
+    if (options.hqRoot)
+        deps.env = { ...deps.env, HQ_ROOT: options.hqRoot };
+    const parsed = parseArguments(argv, deps);
+    if (typeof parsed === "number")
+        return parsed;
+    const hqRoot = parsed.hqRoot || options.hqRoot || deps.env.HQ_ROOT || "";
+    if (hqRoot)
+        deps.env = { ...deps.env, HQ_ROOT: hqRoot };
+    const dryRun = parsed.dryRun || deps.env.HQ_JOB_REMEDIATE_DRY === "1";
+    const actions = [];
+    let attempted = false;
+    let retryRecommended = false;
+    let alwaysHuman = false;
+    let nextAction = "";
+    let notes = "";
+    const logPath = deps.env.HQ_JOB_REMEDIATE_LOG || os.devNull;
+    const log = (message) => deps.stderr(`hq-job-remediate: ${message}\n`);
+    const emit = (code) => {
+        if (code === 2)
+            return 2;
+        deps.stdout(serializeJqJson({
+            failure_class: parsed.failureClass,
+            job_id: parsed.jobId,
+            attempted,
+            actions,
+            retry_recommended: retryRecommended,
+            always_human: alwaysHuman,
+            next_action: nextAction,
+            notes,
+        }, "compact"));
+        return 0;
+    };
+    const runOrDry = (label, command, args) => {
+        actions.push(label);
+        if (dryRun) {
+            log(`dry-run: would run: ${[command, ...args].join(" ")}`);
+            return true;
+        }
+        return deps.run(command, args, { cwd: deps.cwd, env: deps.env, logPath }) === 0;
+    };
+    const runOverrideOrArgv = (label, overrideOrCommand, args = []) => {
+        let command = overrideOrCommand;
+        let commandArgs = args;
+        if (args.length === 0 && overrideOrCommand.includes(" ")) {
+            if (UNSAFE_OVERRIDE.test(overrideOrCommand)) {
+                deps.stderr("hq-job-remediate: unsafe remediate override command rejected\n");
+                return 2;
+            }
+            [command, ...commandArgs] = splitOverrideCommand(overrideOrCommand, deps.cwd);
+            if (!command)
+                return true;
+        }
+        return runOrDry(label, command, commandArgs);
+    };
+    const resolveAuthRefresh = () => {
+        const override = deps.env.HQ_JOB_REMEDIATE_AUTH_REFRESH_CMD || "";
+        if (override)
+            return override;
+        if (deps.commandExists("hq"))
+            return "hq auth refresh";
+        if (deps.commandExists("hq-auth-refresh"))
+            return "hq-auth-refresh";
+        return "";
+    };
+    switch (parsed.failureClass) {
+        case "secrets":
+            alwaysHuman = true;
+            nextAction = "share the missing secret to this Outpost (hq secrets share KEY) then re-probe";
+            notes = "secret share is always-human; no self-remediation";
+            return emit(0);
+        case "auth": {
+            alwaysHuman = true;
+            nextAction = "re-login on Outpost (device code) for the job runtime CLI";
+            notes = "attempt Cognito refresh if available; never loop device re-login";
+            const command = resolveAuthRefresh();
+            if (command) {
+                attempted = true;
+                const result = runOverrideOrArgv("cognito_token_refresh", command);
+                if (result === 2)
+                    return 2;
+                if (result)
+                    notes = "cognito refresh ok; device re-login still required if CLI creds missing";
+                else
+                    notes = "cognito refresh failed or unavailable; device re-login required";
+            }
+            else
+                notes = "no hq auth refresh on PATH; device re-login required";
+            return emit(0);
+        }
+        case "timeout":
+            nextAction = "raise timeout_seconds or split the job work";
+            notes = "timeout is not self-retried in v1 (avoid thrash)";
+            return emit(0);
+        case "agent_error":
+            nextAction = "inspect the job log and fix the prompt/skill";
+            notes = "agent_error is not self-remediated in v1";
+            return emit(0);
+        case "infra": {
+            nextAction = "retry after sync; if it persists, check Outpost disk/network";
+            notes = "allowlist: cognito refresh + one hq-sync pull + single retry";
+            const authCommand = resolveAuthRefresh();
+            if (authCommand) {
+                attempted = true;
+                const result = runOverrideOrArgv("cognito_token_refresh", authCommand);
+                if (result === 2)
+                    return 2;
+            }
+            const syncOverride = deps.env.HQ_JOB_REMEDIATE_SYNC_PULL_CMD || "";
+            attempted = true;
+            if (syncOverride) {
+                const result = runOverrideOrArgv("hq_sync_pull", syncOverride);
+                if (result === 2)
+                    return 2;
+                retryRecommended = true;
+                notes = result ? "sync pull ok; recommend single immediate retry" : "sync pull failed; still recommend one infra retry";
+            }
+            else if (deps.commandExists("hq")) {
+                const syncArgs = parsed.company && parsed.company !== "null"
+                    ? ["sync", "pull", "--company", parsed.company, "--hq-root", hqRoot]
+                    : ["sync", "pull", "--personal", "--hq-root", hqRoot];
+                const result = runOrDry("hq_sync_pull", "hq", syncArgs);
+                retryRecommended = true;
+                notes = result ? "sync pull ok; recommend single immediate retry" : "sync pull failed; still recommend one infra retry";
+            }
+            else {
+                actions.push("hq_sync_pull_unavailable");
+                retryRecommended = true;
+                notes = "hq sync pull unavailable; recommend single infra retry anyway";
+            }
+            return emit(0);
+        }
+        default:
+            // parseArguments rejects unknown classes before any remediation path.
+            return 2;
+    }
+}
+export function registerCoreJobRemediateNativeCommand(group, core) {
+    registerCoreJobLeaf(group, core, "remediate", ASSET, "Run bounded remediation for a scheduled-job failure", (argv, hqRoot) => runJobRemediate(argv, { hqRoot }), canUseLiveRootForArguments, [
+        "--hq-root", "--failure-class", "--job-id", "--company",
+    ], ["--dry-run"]);
+}
+//# sourceMappingURL=core-job-remediate-native.js.map

package/dist/commands/core-job-remote-launcher.d.ts

@@ -0,0 +1,7 @@
+export type RemoteLauncherDependencies = {
+    runAgent(binary: string, args: string[], cwd: string): Promise<number>;
+    writeExitFile(file: string, exitCode: number): void;
+    sleep(milliseconds: number): Promise<void>;
+};
+export declare function runRemoteLauncher(argv: string[], injected?: Partial<RemoteLauncherDependencies>): Promise<number>;
+//# sourceMappingURL=core-job-remote-launcher.d.ts.map

package/dist/commands/core-job-remote-launcher.js

@@ -0,0 +1,51 @@
+import { spawn } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+function signalNumber(signal) {
+    if (!signal)
+        return 0;
+    return { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15 }[signal] ?? 0;
+}
+const defaultDependencies = {
+    runAgent: (binary, args, cwd) => new Promise((resolve) => {
+        let settled = false;
+        const child = spawn(binary, args, { cwd, stdio: "inherit" });
+        child.once("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            process.stderr.write(`${binary}: ${error.message}\n`);
+            resolve(127);
+        });
+        child.once("close", (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(code ?? 128 + signalNumber(signal));
+        });
+    }),
+    writeExitFile: (file, exitCode) => fs.writeFileSync(file, `EXIT=${exitCode}\n`),
+    sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+};
+export async function runRemoteLauncher(argv, injected = {}) {
+    const [exitFile, ...agentArgs] = argv;
+    if (!exitFile || agentArgs.length === 0) {
+        process.stderr.write("core-job-remote-launcher: expected exit file and Claude arguments\n");
+        return 2;
+    }
+    const deps = { ...defaultDependencies, ...injected };
+    const exitCode = await deps.runAgent("claude", agentArgs, process.cwd());
+    deps.writeExitFile(exitFile, exitCode);
+    await deps.sleep(15_000);
+    return exitCode;
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    void runRemoteLauncher(process.argv.slice(2))
+        .then((exitCode) => { process.exitCode = exitCode; })
+        .catch((error) => {
+        process.stderr.write(`core-job-remote-launcher: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=core-job-remote-launcher.js.map

package/dist/commands/core-job-run-native.d.ts

@@ -0,0 +1,47 @@
+/** Native TypeScript port of the serialized scheduled-job runner. */
+import { Command } from "commander";
+import * as fs from "node:fs";
+export declare const OUTPOST_IDENTITY_FILE = "/etc/outpost/codex-identity.env";
+export declare const OUTPOST_RUNNER_FILE = "/usr/local/bin/outpost-runner.sh";
+type ProcessResult = {
+    code: number;
+    stdout: Buffer;
+    stderr: Buffer;
+};
+export type ProcessRequest = {
+    file: string;
+    args: string[];
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    logPath?: string;
+    timeoutMs?: number;
+};
+type LockLease = {
+    release(): Promise<void>;
+};
+export type JobRunDependencies = {
+    env: NodeJS.ProcessEnv;
+    cwd: string;
+    home: string;
+    now(): Date;
+    epochNow(): number;
+    readFile(file: string): Buffer;
+    stat(file: string): fs.Stats;
+    mkdir(directory: string): void;
+    writeFile(file: string, content: string | Buffer): void;
+    appendFile(file: string, content: string | Buffer): void;
+    chmod(file: string, mode: number): void;
+    remove(file: string): void;
+    fetch(input: string, init: RequestInit): Promise<Response>;
+    runProcess(request: ProcessRequest): Promise<ProcessResult>;
+    acquireLock(file: string): Promise<LockLease>;
+    sleep(milliseconds: number): Promise<void>;
+    scriptPath: string;
+};
+export declare function spawnProcess(request: ProcessRequest): Promise<ProcessResult>;
+/** Holds the same kernel flock(2) lock used by the shell companion. */
+export declare function acquireFlock(file: string, env?: NodeJS.ProcessEnv): Promise<LockLease>;
+export declare function runJob(argv: string[], hqRootOverride?: string, injected?: Partial<JobRunDependencies>): Promise<number>;
+export declare function registerCoreJobRunCommand(job: Command): void;
+export {};
+//# sourceMappingURL=core-job-run-native.d.ts.map