@indigoai-us/hq-cli 5.62.2 → 5.64.0

package/src/commands/billing.ts

@@ -0,0 +1,146 @@
+/**
+ * `hq billing` — inspect billing state and mint a card-capture link from the
+ * terminal. Backs the paid-provisioning gate (agents & Outposts): a user can
+ * check whether a card is on file, and proactively hand out the same Stripe
+ * hosted card-capture link that a `402 billing_required` would surface.
+ *
+ * Targets the hq-pro billing control plane on `DEFAULT_VAULT_API_URL` via the
+ * shared `vaultApiFetch` helper — the same routes the console billing surfaces
+ * call.
+ *
+ * Subcommands:
+ *   hq billing status   [--company <slug>]              — subscription + card on file
+ *   hq billing checkout [--company <slug>] [--personal] — mint a card-capture link
+ */
+
+import { Command } from "commander";
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { mintPaymentLink, type BillingSetupAction } from "../utils/billing-gate.js";
+
+/** Shape of `GET /v1/billing/summary` we render. */
+interface BillingSummary {
+  subscriptionStatus: string | null;
+  defaultPaymentMethod: {
+    present: boolean;
+    brand: string | null;
+    last4: string | null;
+  };
+  [key: string]: unknown;
+}
+
+function fail(err: unknown): never {
+  console.error(
+    chalk.red("Error:"),
+    err instanceof Error ? err.message : String(err),
+  );
+  process.exit(1);
+}
+
+async function getBillingSummary(
+  token: string,
+  companyUid: string,
+): Promise<BillingSummary> {
+  const res = await vaultApiFetch({
+    token,
+    path: "/v1/billing/summary",
+    query: { companyUid },
+  });
+  if (!res.ok) {
+    const body = (await res.json().catch(() => ({}))) as {
+      error?: string;
+      message?: string;
+    };
+    throw new Error(body.error ?? body.message ?? res.statusText);
+  }
+  return (await res.json()) as BillingSummary;
+}
+
+export function registerBillingCommand(program: Command): void {
+  const billing = program
+    .command("billing")
+    .description("Inspect billing and mint a card-capture link")
+    .option("--company <slug>", "Company slug (resolves to companyUid)");
+
+  const companyOf = (sub: Command): string | undefined =>
+    (sub.opts().company as string | undefined) ??
+    (billing.opts().company as string | undefined);
+
+  billing
+    .command("status")
+    .description("Show subscription status and whether a card is on file")
+    .option("--company <slug>", "Company slug (resolves to companyUid)")
+    .option("--json", "Emit raw JSON")
+    .action(async function (this: Command, opts: { json?: boolean }) {
+      try {
+        const token = await ensureCognitoToken();
+        const companyUid = await getCompanyUid(token, companyOf(this));
+        const summary = await getBillingSummary(token, companyUid);
+        if (opts.json) {
+          process.stdout.write(JSON.stringify(summary, null, 2) + "\n");
+          return;
+        }
+        const sub = summary.subscriptionStatus ?? "none";
+        console.log(`${chalk.bold("Subscription")}: ${sub}`);
+        const pm = summary.defaultPaymentMethod;
+        if (pm?.present) {
+          const detail =
+            pm.brand && pm.last4 ? `${pm.brand} ••••${pm.last4}` : "on file";
+          console.log(`${chalk.bold("Card")}: ${detail}`);
+        } else {
+          console.log(
+            `${chalk.bold("Card")}: ${chalk.yellow("no card on file")} — ` +
+              `run \`hq billing checkout\` to add one before provisioning paid resources.`,
+          );
+        }
+      } catch (err) {
+        fail(err);
+      }
+    });
+
+  billing
+    .command("checkout")
+    .description("Mint a Stripe card-capture link (shareable) to add a card")
+    .option("--company <slug>", "Company slug (resolves to companyUid)")
+    .option(
+      "--personal",
+      "Mint the link for your personal payer (Outposts) instead of a company",
+    )
+    .option("--json", "Emit raw JSON")
+    .action(async function (
+      this: Command,
+      opts: { personal?: boolean; json?: boolean },
+    ) {
+      try {
+        const token = await ensureCognitoToken();
+        let setup: BillingSetupAction;
+        if (opts.personal) {
+          setup = {
+            payerType: "person",
+            path: "/v1/billing/checkout/person",
+            method: "POST",
+          };
+        } else {
+          const companyUid = await getCompanyUid(token, companyOf(this));
+          setup = {
+            payerType: "company",
+            path: "/v1/billing/checkout/org",
+            method: "POST",
+            body: { companyUid },
+          };
+        }
+        const url = await mintPaymentLink(token, setup);
+        if (opts.json) {
+          process.stdout.write(JSON.stringify({ url }, null, 2) + "\n");
+          return;
+        }
+        console.log(
+          "Add a card here (safe to share with whoever owns billing):\n  " +
+            chalk.cyan(url),
+        );
+      } catch (err) {
+        fail(err);
+      }
+    });
+}

package/src/commands/members.test.ts

@@ -1194,6 +1194,24 @@ describe("registerMembersCommand promote", () => {
 // ---------------------------------------------------------------------------
 
 describe("resolveRevokeTargetToMembershipKey", () => {
+  it("wraps fleet agent uids as agt_…#companyUid", () => {
+    expect(
+      resolveRevokeTargetToMembershipKey(
+        "agt_01HXYZABCDEFGHJKMNPQRSTVWX",
+        "cmp_abc",
+      ),
+    ).toBe("agt_01HXYZABCDEFGHJKMNPQRSTVWX#cmp_abc");
+  });
+
+  it("maps agent machine emails to agt_…#companyUid (active guest memberships)", () => {
+    expect(
+      resolveRevokeTargetToMembershipKey(
+        "agt-01hxyzabcdefghjkmnpqrstvwx@agents.getindigo.ai",
+        "cmp_abc",
+      ),
+    ).toBe("agt_01HXYZABCDEFGHJKMNPQRSTVWX#cmp_abc");
+  });
+
   // Regression: `hq members revoke alice@example.com` used to send the raw
   // email straight to /membership/revoke, which the server rejects with 404
   // "Invite not found" because it keys on `email:<email>#<companyUid>`. Live

package/src/commands/members.ts

@@ -494,9 +494,16 @@ export function resolveRevokeTargetToMembershipKey(
   if (arg.includes("#")) return arg;
   const detected = detectTarget(arg);
   if (detected?.type === "email") {
+    // Active agent guest memberships are personUid-keyed (agt_…#cmp_…), not
+    // email-keyed. Map machine emails to that key so revoke works after invite.
+    if (detected.isAgent) {
+      const local = detected.value.split("@")[0] ?? "";
+      const m = local.match(/^agt-(.+)$/i);
+      if (m) return `agt_${m[1].toUpperCase()}#${companyUid}`;
+    }
     return `email:${detected.value}#${companyUid}`;
   }
-  if (detected?.type === "person") {
+  if (detected?.type === "person" || detected?.type === "agent") {
     return `${detected.value}#${companyUid}`;
   }
   return arg;

package/src/commands/outposts.test.ts

@@ -27,6 +27,21 @@ vi.mock("../utils/cognito-session.js", async (importOriginal) => {
   };
 });
 
+// Outpost provision reads the cached refresh token to send to the box. Stub the
+// hq-cloud token store so tests don't need a real session on disk.
+vi.mock("@indigoai-us/hq-cloud", async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import("@indigoai-us/hq-cloud")>();
+  return {
+    ...original,
+    loadCachedTokens: vi.fn(() => ({
+      refreshToken: "rt_test",
+      idToken: "id_test",
+      accessToken: "at_test",
+    })),
+  };
+});
+
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { registerOutpostsCommand } from "./outposts.js";
 
@@ -175,3 +190,167 @@ describe("hq outposts destroy", () => {
     ).rejects.toThrow("process.exit(1)");
   });
 });
+
+describe("hq outposts provision (billing gate)", () => {
+  it("refuses without --yes, prints the cost, and makes NO API call", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    await expect(run(["outposts", "provision"])).rejects.toThrow(
+      "process.exit(1)",
+    );
+    expect(fetchSpy).not.toHaveBeenCalled();
+    const printed = errSpy.mock.calls
+      .map((c) => c.map(String).join(" "))
+      .join("\n");
+    expect(printed).toMatch(/\$80\.00\/month/);
+  });
+
+  it("POSTs /outpost/provision with the refresh token when --yes", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { ok: true }));
+    await run(["outposts", "provision", "--runtime", "codex", "--yes"]);
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/outpost/provision");
+    expect(init?.method).toBe("POST");
+    const sent = JSON.parse(init?.body as string);
+    expect(sent.refreshToken).toBe("rt_test");
+    expect(sent.agentRuntime).toBe("codex");
+  });
+
+  it("mints a card-capture link on 402 billing_required and exits 1", async () => {
+    fetchSpy
+      .mockResolvedValueOnce(
+        jsonResponse(402, {
+          error: "payment required",
+          billing: {
+            status: "billing_required",
+            setup: {
+              payerType: "person",
+              path: "/v1/billing/checkout/person",
+              method: "POST",
+            },
+          },
+        }),
+      )
+      .mockResolvedValueOnce(
+        jsonResponse(200, { url: "https://checkout.stripe.com/outpost" }),
+      );
+
+    await expect(
+      run(["outposts", "provision", "--yes"]),
+    ).rejects.toThrow("process.exit(1)");
+
+    expect(String(fetchSpy.mock.calls[1][0])).toContain(
+      "/v1/billing/checkout/person",
+    );
+    const printed = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(printed).toContain("https://checkout.stripe.com/outpost");
+  });
+});
+
+describe("hq outposts exec", () => {
+  afterEach(() => {
+    process.exitCode = undefined;
+  });
+
+  it("POSTs /outpost/exec with the joined command and streams stdout", async () => {
+    const stdoutSpy = vi
+      .spyOn(process.stdout, "write")
+      .mockImplementation(() => true);
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        ok: true,
+        outpostId: "primary",
+        instanceId: "i-abc",
+        commandId: "cmd-1",
+        status: "Success",
+        exitCode: 0,
+        stdout: "hello world\n",
+        stderr: "",
+        truncated: false,
+      }),
+    );
+
+    await run(["outposts", "exec", "echo", "hello", "world"]);
+
+    const [url, init] = fetchSpy.mock.calls[0];
+    expect(String(url)).toContain("/outpost/exec");
+    expect(init?.method).toBe("POST");
+    expect(JSON.parse(init?.body as string)).toEqual({ command: "echo hello world" });
+    const printed = stdoutSpy.mock.calls.map((c) => String(c[0])).join("");
+    expect(printed).toContain("hello world\n");
+    expect(process.exitCode).toBe(0);
+  });
+
+  it("propagates a non-zero remote exit code", async () => {
+    vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        ok: true,
+        outpostId: "primary",
+        instanceId: "i-abc",
+        commandId: "cmd-2",
+        status: "Failed",
+        exitCode: 2,
+        stdout: "",
+        stderr: "nope\n",
+        truncated: false,
+      }),
+    );
+    await run(["outposts", "exec", "exit", "2"]);
+    expect(process.exitCode).toBe(2);
+  });
+
+  it("passes --id through as the outpostId query param", async () => {
+    vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        ok: true,
+        outpostId: "2",
+        instanceId: "i-2",
+        commandId: "c",
+        status: "Success",
+        exitCode: 0,
+        stdout: "",
+        stderr: "",
+        truncated: false,
+      }),
+    );
+    await run(["outposts", "exec", "--id", "2", "uptime"]);
+    expect(String(fetchSpy.mock.calls[0][0])).toContain("outpostId=2");
+  });
+
+  it("exits 1 and surfaces the server message on a non-2xx (e.g. not-ready)", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(409, {
+        error: true,
+        step: "not-ready",
+        message: 'outpost is "provisioning", not ready — it must be running to exec',
+      }),
+    );
+    await expect(
+      run(["outposts", "exec", "echo", "hi"]),
+    ).rejects.toThrow("process.exit(1)");
+  });
+
+  it("emits raw JSON with --json", async () => {
+    const stdoutSpy = vi
+      .spyOn(process.stdout, "write")
+      .mockImplementation(() => true);
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        ok: true,
+        outpostId: "primary",
+        instanceId: "i-abc",
+        commandId: "cmd-3",
+        status: "Success",
+        exitCode: 0,
+        stdout: "x\n",
+        stderr: "",
+        truncated: false,
+      }),
+    );
+    await run(["outposts", "exec", "--json", "echo", "x"]);
+    const printed = stdoutSpy.mock.calls.map((c) => String(c[0])).join("");
+    expect(printed).toContain('"commandId": "cmd-3"');
+  });
+});

package/src/commands/outposts.ts

@@ -23,18 +23,34 @@
 
 import { Command } from "commander";
 import chalk from "chalk";
+import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
+import {
+  OUTPOST_PRICE_CENTS,
+  confirmChargeOrExit,
+  parseBillingPayload,
+  surfaceBillingRequired,
+  type BillingErrorPayload,
+} from "../utils/billing-gate.js";
 
 /** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
 export class OutpostHttpError extends Error {
   status: number;
   step?: string;
-  constructor(status: number, message: string, step?: string) {
+  /** hq-pro's billing envelope on a `402 billing_required` provision block. */
+  billing?: BillingErrorPayload;
+  constructor(
+    status: number,
+    message: string,
+    step?: string,
+    billing?: BillingErrorPayload,
+  ) {
     super(message);
     this.name = "OutpostHttpError";
     this.status = status;
     this.step = step;
+    this.billing = billing;
   }
 }
 
@@ -61,6 +77,7 @@ export async function outpostRequest<T>(opts: {
   token: string;
   path: string;
   method?: string;
+  body?: Record<string, unknown>;
   query?: Record<string, string>;
 }): Promise<T> {
   const res = await vaultApiFetch(opts);
@@ -76,11 +93,45 @@ export async function outpostRequest<T>(opts: {
         : typeof body.error === "string"
           ? body.error
           : res.statusText;
-    throw new OutpostHttpError(res.status, message, body.step);
+    throw new OutpostHttpError(
+      res.status,
+      message,
+      body.step,
+      parseBillingPayload(body),
+    );
   }
   return (await res.json()) as T;
 }
 
+/**
+ * Provision the caller's Outpost. Sends the cached Cognito refresh token so the
+ * box can authenticate AS the caller (the same body the console's
+ * `provisionMyOutpost` sends). Idempotent server-side: a caller already at their
+ * per-person cap gets their existing box back rather than a duplicate. The
+ * refresh token is sent over HTTPS and NEVER printed.
+ */
+export async function provisionOutpost(
+  token: string,
+  input: {
+    refreshToken: string;
+    clientIp?: string;
+    diskSizeGb?: number;
+    agentRuntime?: "claude" | "codex";
+  },
+): Promise<Record<string, unknown>> {
+  return outpostRequest({
+    token,
+    path: "/outpost/provision",
+    method: "POST",
+    body: {
+      refreshToken: input.refreshToken,
+      ...(input.clientIp ? { clientIp: input.clientIp } : {}),
+      ...(input.diskSizeGb ? { diskSizeGb: input.diskSizeGb } : {}),
+      ...(input.agentRuntime ? { agentRuntime: input.agentRuntime } : {}),
+    },
+  });
+}
+
 export async function listOutposts(token: string): Promise<OutpostSummary[]> {
   const data = await outpostRequest<{ outposts: OutpostSummary[] }>({
     token,
@@ -136,6 +187,41 @@ export async function destroyOutpost(
   });
 }
 
+/** Result of `POST /outpost/exec` — a terminal SSM invocation on the box. */
+export interface OutpostExecResult {
+  ok: true;
+  outpostId: string;
+  instanceId: string;
+  commandId: string;
+  /** SSM invocation status (Success | Failed | Cancelled). */
+  status: string;
+  /** Remote process exit code, or null when SSM reported none. */
+  exitCode: number | null;
+  stdout: string;
+  stderr: string;
+  /** True when SSM clipped stdout/stderr at its inline output limit. */
+  truncated: boolean;
+}
+
+/**
+ * Run a one-shot shell command on the caller's Outpost via `POST /outpost/exec`
+ * (server-brokered SSM — no SSH). Throws `OutpostHttpError` on a non-2xx, whose
+ * `step` distinguishes not-ready / platform-unsupported / timeout / ssm.
+ */
+export async function execOutpost(
+  token: string,
+  command: string,
+  outpostId?: string,
+): Promise<OutpostExecResult> {
+  return outpostRequest({
+    token,
+    path: "/outpost/exec",
+    method: "POST",
+    body: { command },
+    query: outpostId ? { outpostId } : undefined,
+  });
+}
+
 // ---------------------------------------------------------------------------
 // Command registration
 // ---------------------------------------------------------------------------
@@ -165,6 +251,81 @@ export function registerOutpostsCommand(program: Command): void {
     .command("outposts")
     .description("Manage your personal HQ Outposts (EC2 boxes)");
 
+  outposts
+    .command("provision")
+    .alias("create")
+    .description("Provision a new Outpost ($80/month — requires --yes)")
+    .option("--runtime <runtime>", "Agent runtime: claude | codex (default claude)")
+    .option("--disk <gb>", "Root disk size in GB (EC2 only)")
+    .option(
+      "--client-ip <ip>",
+      "Your public IP for the box's SSH ingress (optional; server derives it otherwise)",
+    )
+    .option("--yes", "Confirm the $80/month charge (required to provision)")
+    .action(async function (
+      this: Command,
+      opts: { runtime?: string; disk?: string; clientIp?: string; yes?: boolean },
+    ) {
+      try {
+        const agentRuntime =
+          opts.runtime === "codex"
+            ? "codex"
+            : opts.runtime
+              ? "claude"
+              : undefined;
+        let diskSizeGb: number | undefined;
+        if (opts.disk !== undefined) {
+          diskSizeGb = Number(opts.disk);
+          if (!Number.isFinite(diskSizeGb) || diskSizeGb <= 0) {
+            console.error(chalk.red(`Invalid --disk '${opts.disk}': must be a positive number of GB.`));
+            process.exit(1);
+          }
+        }
+
+        // Paid gate: print the monthly cost and require --yes before any call.
+        confirmChargeOrExit({
+          resource: "Outpost",
+          unitCents: OUTPOST_PRICE_CENTS,
+          yes: opts.yes,
+        });
+
+        // The box authenticates AS the caller using the cached refresh token —
+        // the same body the console sends. Never printed.
+        const refreshToken = loadCachedTokens()?.refreshToken;
+        if (!refreshToken) {
+          console.error(
+            chalk.red("No cached session found — run `hq login` first, then re-run."),
+          );
+          process.exit(1);
+        }
+
+        const token = await ensureCognitoToken();
+        try {
+          await provisionOutpost(token, {
+            refreshToken,
+            ...(opts.clientIp ? { clientIp: opts.clientIp } : {}),
+            ...(diskSizeGb ? { diskSizeGb } : {}),
+            ...(agentRuntime ? { agentRuntime } : {}),
+          });
+          console.log(chalk.green("Provisioning started for your Outpost."));
+          console.log(chalk.dim("Track it: hq outposts status"));
+        } catch (err) {
+          // No card on file → surface the shareable payment link, not an opaque 402.
+          if (
+            err instanceof OutpostHttpError &&
+            err.status === 402 &&
+            err.billing
+          ) {
+            await surfaceBillingRequired(token, err.billing);
+            process.exit(1);
+          }
+          throw err;
+        }
+      } catch (err) {
+        fail(err);
+      }
+    });
+
   outposts
     .command("list")
     .description("List every Outpost you own")
@@ -243,6 +404,51 @@ export function registerOutpostsCommand(program: Command): void {
       }
     });
 
+  outposts
+    .command("exec <command...>")
+    .description(
+      "Run a shell command on an Outpost and print its output (use -- before flags meant for the remote command)",
+    )
+    .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+    .option("--json", "Emit raw JSON")
+    .action(async function (
+      this: Command,
+      commandParts: string[],
+      opts: { id?: string; json?: boolean },
+    ) {
+      try {
+        const command = commandParts.join(" ").trim();
+        if (!command) {
+          console.error(chalk.red("No command given. Usage: hq outposts exec -- <command>"));
+          process.exit(1);
+        }
+        const token = await ensureCognitoToken();
+        const result = await execOutpost(token, command, opts.id);
+
+        if (opts.json) {
+          process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        } else {
+          // Stream the remote streams to ours so the command feels local, then
+          // exit with the remote exit code.
+          if (result.stdout) process.stdout.write(result.stdout);
+          if (result.stderr) process.stderr.write(result.stderr);
+          if (result.truncated) {
+            console.error(
+              chalk.yellow("(output truncated by SSM's inline limit — redirect to a file on the box for full output)"),
+            );
+          }
+          if (result.status !== "Success" && result.exitCode === null) {
+            console.error(chalk.yellow(`(command ended with SSM status: ${result.status})`));
+          }
+        }
+        // Propagate the remote exit code so `hq outposts exec -- false` exits 1.
+        process.exitCode =
+          typeof result.exitCode === "number" ? result.exitCode : 0;
+      } catch (err) {
+        fail(err);
+      }
+    });
+
   outposts
     .command("codex-enable")
     .description("Enable (or retry) Codex on an Outpost")

package/src/main.ts

@@ -56,6 +56,7 @@ import { registerCrmCommand } from "./commands/crm.js";
 import { registerCompanyCommand } from "./commands/company.js";
 import { registerAgentsCommand } from "./commands/agents.js";
 import { registerOutpostsCommand } from "./commands/outposts.js";
+import { registerBillingCommand } from "./commands/billing.js";
 import { registerDbCommand } from "./commands/db.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
@@ -258,6 +259,11 @@ registerAgentsCommand(program);
 // /outpost/* control plane.
 registerOutpostsCommand(program);
 
+// Billing (subcommand group — `hq billing …`). Check subscription/card state and
+// mint a shareable Stripe card-capture link — the client side of the paid-
+// provisioning gate for agents & Outposts.
+registerBillingCommand(program);
+
 export async function runCli(): Promise<void> {
   try {
     Sentry.addBreadcrumb({