@indigoai-us/hq-cli 5.68.2 → 5.69.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [5.69.0]
+
+### Added
+
+- **`hq outposts self-deploy` (hidden).** Run on an existing Amazon Linux 2023
+  x86_64 EC2 by a logged-in user to make that box behave like an HQ outpost
+  locally: it materializes the HQ kernel (`hq rescue`) and installs the
+  `outpost-sync.service` (`hq-sync-runner --companies --watch`) so the box
+  continuously syncs all your company vaults. It is entirely client-side — it
+  makes no calls to hq-pro, registers no outpost row, and is not reported to or
+  managed by the control plane (no console entry, no metering). Gated by a
+  preflight (OS/arch/systemd/root/login) and a confirmation prompt (`--yes`).
+
 ## [5.68.1]
 
 ### Fixed

package/dist/commands/outposts.d.ts

@@ -21,6 +21,7 @@
  * and status routes that exist. Renaming an Outpost is not a backend capability.
  */
 import { Command } from "commander";
+import { spawnSync } from "node:child_process";
 import { type BillingErrorPayload } from "../utils/billing-gate.js";
 /** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
 export declare class OutpostHttpError extends Error {
@@ -137,5 +138,19 @@ export declare function execViaSsh(access: OutpostSshAccess, command: string): {
     exitCode: number | null;
     error?: string;
 };
-export declare function registerOutpostsCommand(program: Command): void;
+/** The small local-environment surface used by `outposts self-deploy`. */
+export interface SelfDeployDependencies {
+    spawnSync: (command: string, args: string[], options?: Parameters<typeof spawnSync>[2]) => ReturnType<typeof spawnSync>;
+    readTextFile: (file: string) => string;
+    loadCachedTokens: () => {
+        refreshToken?: string;
+        idToken?: string;
+    } | undefined;
+    getUid: () => number | undefined;
+    isStdinTty: () => boolean;
+    confirm: () => Promise<boolean>;
+    defaultHqRoot: () => string;
+    invokingUser: () => string;
+}
+export declare function registerOutpostsCommand(program: Command, selfDeployOverrides?: Partial<SelfDeployDependencies>): void;
 //# sourceMappingURL=outposts.d.ts.map

package/dist/commands/outposts.js

@@ -21,12 +21,13 @@
  * and status routes that exist. Renaming an Outpost is not a backend capability.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c4ce2b27-be72-5025-a4e7-2d4725c67c26")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ff8d1d83-feab-5f6f-bf48-e4fde1a8d449")}catch(e){}}();
 import chalk from "chalk";
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import * as readline from "node:readline";
 import { randomBytes } from "node:crypto";
 import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
@@ -239,10 +240,236 @@ function printKeyValues(obj) {
         console.log(`${chalk.bold(k)}: ${rendered}`);
     }
 }
-export function registerOutpostsCommand(program) {
+const defaultSelfDeployDependencies = {
+    spawnSync: (command, args, options) => spawnSync(command, args, options),
+    readTextFile: (file) => fs.readFileSync(file, "utf8"),
+    loadCachedTokens: () => loadCachedTokens() ?? undefined,
+    getUid: () => process.getuid?.(),
+    isStdinTty: () => process.stdin.isTTY === true,
+    confirm: async () => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        return new Promise((resolve) => {
+            rl.question("", (answer) => {
+                rl.close();
+                resolve(/^y(es)?$/i.test(answer.trim()));
+            });
+        });
+    },
+    defaultHqRoot: () => process.env.HQ_ROOT ?? path.join(os.homedir(), "hq"),
+    invokingUser: () => process.env.SUDO_USER ?? process.env.USER ?? os.userInfo().username,
+};
+function selfDeployError(message) {
+    return new Error(`Self-deploy preflight failed: ${message}`);
+}
+function commandSucceeded(deps, command, args) {
+    try {
+        const result = deps.spawnSync(command, args, { encoding: "utf8" });
+        return !!result && !result.error && result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function commandOutput(deps, command, args) {
+    try {
+        const result = deps.spawnSync(command, args, { encoding: "utf8" });
+        if (!result || result.error || result.status !== 0)
+            return undefined;
+        return String(result.stdout ?? "").trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseOsRelease(source) {
+    const values = new Map();
+    for (const line of source.split("\n")) {
+        const match = /^([A-Z_]+)=(.*)$/.exec(line);
+        if (!match)
+            continue;
+        const [, key, rawValue] = match;
+        values.set(key, rawValue.replace(/^['"]|['"]$/g, ""));
+    }
+    return values;
+}
+function hqIdentityFromSession(session) {
+    if (!session.idToken)
+        return "your cached HQ session";
+    try {
+        const payload = session.idToken.split(".")[1];
+        if (!payload)
+            return "your cached HQ session";
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        for (const key of [
+            "email",
+            "preferred_username",
+            "cognito:username",
+            "username",
+            "sub",
+        ]) {
+            const value = claims[key];
+            if (typeof value === "string" && value)
+                return value;
+        }
+    }
+    catch {
+        // A cache that has a refresh token remains valid for this local setup. The
+        // identity banner is informational, so never expose a token parse failure.
+    }
+    return "your cached HQ session";
+}
+function bashSingleQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function systemdQuoted(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function renderSelfDeploySyncScript(hqRoot) {
+    return `#!/usr/bin/env bash
+set -u
+# Persistent all-membership sync for a locally self-hosted HQ outpost. The
+# watch runner event-pushes local changes and polls remote changes every minute.
+HQ_ROOT=${bashSingleQuote(hqRoot)}
+cd "$HQ_ROOT"
+while true; do
+  hq auth refresh || echo "[outpost-sync] auth refresh failed, continuing"
+  npx -y --package=@indigoai-us/hq-cloud@latest hq-sync-runner \\
+    --companies \\
+    --direction both \\
+    --on-conflict keep \\
+    --hq-root "$HQ_ROOT" \\
+    --watch \\
+    --event-push \\
+    --poll-remote-ms 60000
+  echo "[outpost-sync] watch runner exited; restarting in 10 seconds"
+  sleep 10
+done
+`;
+}
+function renderSelfDeployService(hqRoot, user) {
+    return `[Unit]
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=${user}
+WorkingDirectory=${systemdQuoted(hqRoot)}
+ExecStart=/usr/local/bin/outpost-sync.sh
+Restart=always
+RestartSec=10s
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function runChecked(deps, command, args, description, options) {
+    let result;
+    try {
+        result = deps.spawnSync(command, args, options);
+    }
+    catch {
+        throw new Error(`${description} could not be started.`);
+    }
+    if (!result || result.error || result.status !== 0) {
+        // Do not include child process output here: even though this command never
+        // passes credentials to children, it keeps the error path secret-safe.
+        throw new Error(`${description} failed. Resolve the error and try again.`);
+    }
+}
+function runPrivileged(deps, command, args, description, options) {
+    if (deps.getUid() === 0) {
+        runChecked(deps, command, args, description, options);
+        return;
+    }
+    runChecked(deps, "sudo", [command, ...args], description, options);
+}
+function selfDeployPreflight(deps) {
+    let osRelease;
+    try {
+        osRelease = deps.readTextFile("/etc/os-release");
+    }
+    catch {
+        throw selfDeployError("could not read /etc/os-release. This command only supports Amazon Linux 2023 x86_64.");
+    }
+    const release = parseOsRelease(osRelease);
+    if (release.get("ID") !== "amzn" ||
+        !release.get("VERSION_ID")?.startsWith("2023")) {
+        throw selfDeployError("this command only supports Amazon Linux 2023 x86_64. Use an Amazon Linux 2023 EC2 instance.");
+    }
+    const architecture = commandOutput(deps, "uname", ["-m"]);
+    if (architecture !== "x86_64") {
+        throw selfDeployError("this command only supports x86_64 EC2 instances. Use an Amazon Linux 2023 x86_64 instance.");
+    }
+    if (!commandSucceeded(deps, "systemctl", ["--version"])) {
+        throw selfDeployError("systemd is required but `systemctl --version` failed. Run this on an Amazon Linux 2023 EC2 host with systemd.");
+    }
+    if (deps.getUid() !== 0 && !commandSucceeded(deps, "sudo", ["-n", "true"])) {
+        throw selfDeployError("root or passwordless sudo is required. Configure passwordless sudo or run this command as root.");
+    }
+    const session = deps.loadCachedTokens();
+    if (!session?.refreshToken) {
+        throw selfDeployError("no HQ login session was found. Run `hq login`, then re-run this command.");
+    }
+    return session;
+}
+async function selfDeployOutpost(opts, deps) {
+    const session = selfDeployPreflight(deps);
+    const hqRoot = opts.hqRoot ?? deps.defaultHqRoot();
+    const user = deps.invokingUser();
+    if (!opts.yes) {
+        console.log(`HQ identity: ${hqIdentityFromSession(session)}`);
+        console.log(chalk.yellow("This machine will run as a SELF-HOSTED HQ outpost under YOUR identity, continuously syncing ALL your company vaults. " +
+            "It is NOT registered with or managed by hq-pro (no console entry, no remote management, no metering). " +
+            "Anyone with root on this box can act as you. Continue? [y/N]"));
+        if (!deps.isStdinTty()) {
+            throw new Error("Confirmation requires a TTY. Pass --yes to continue non-interactively.");
+        }
+        if (!(await deps.confirm())) {
+            throw new Error("Self-deploy cancelled.");
+        }
+    }
+    runChecked(deps, "hq", ["rescue", "--hq-root", hqRoot, "--yes"], "HQ kernel rescue", { stdio: "inherit" });
+    runPrivileged(deps, "tee", ["/usr/local/bin/outpost-sync.sh"], "Writing /usr/local/bin/outpost-sync.sh", {
+        encoding: "utf8",
+        input: renderSelfDeploySyncScript(hqRoot),
+        stdio: ["pipe", "ignore", "pipe"],
+    });
+    runPrivileged(deps, "chmod", ["+x", "/usr/local/bin/outpost-sync.sh"], "Making /usr/local/bin/outpost-sync.sh executable");
+    runPrivileged(deps, "tee", ["/etc/systemd/system/outpost-sync.service"], "Writing /etc/systemd/system/outpost-sync.service", {
+        encoding: "utf8",
+        input: renderSelfDeployService(hqRoot, user),
+        stdio: ["pipe", "ignore", "pipe"],
+    });
+    runPrivileged(deps, "systemctl", ["daemon-reload"], "Reloading systemd");
+    runPrivileged(deps, "systemctl", ["enable", "--now", "outpost-sync.service"], "Enabling outpost-sync.service");
+    console.log(chalk.green("This box is now a self-hosted HQ outpost and will sync all your company vaults continuously."));
+    console.log(chalk.dim("Check it with: systemctl status outpost-sync.service"));
+    console.log(chalk.dim("It is unregistered and unmanaged by hq-pro (no console entry or remote management)."));
+}
+export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
+    const selfDeployDependencies = {
+        ...defaultSelfDeployDependencies,
+        ...selfDeployOverrides,
+    };
     const outposts = program
         .command("outposts")
         .description("Manage your personal HQ Outposts (EC2 boxes)");
+    outposts
+        .command("self-deploy", { hidden: true })
+        .description("Configure this EC2 host as a locally self-hosted HQ outpost")
+        .option("--yes", "Skip the self-hosting confirmation")
+        .option("--hq-root <path>", "HQ root to sync", selfDeployDependencies.defaultHqRoot())
+        .action(async (opts) => {
+        try {
+            await selfDeployOutpost(opts, selfDeployDependencies);
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
     outposts
         .command("provision")
         .alias("create")
@@ -514,4 +741,4 @@ export function registerOutpostsCommand(program) {
     });
 }
 //# sourceMappingURL=outposts.js.map
-//# debugId=c4ce2b27-be72-5025-a4e7-2d4725c67c26
+//# debugId=ff8d1d83-feab-5f6f-bf48-e4fde1a8d449

package/dist/main.js

@@ -5,7 +5,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1cc9f0b6-d8a8-54ea-a85f-44437f67b856")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d6747715-2057-5a0c-bfc5-c0a8372639d0")}catch(e){}}();
 import "./node-preflight.js";
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
@@ -65,6 +65,7 @@ import { isInterceptedProcessExit } from "./utils/intercepted-process-exit.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
 import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { CLI_VERSION } from "./cli-version.js";
+import { emitCliSessionStarted } from "./utils/cli-telemetry.js";
 // Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes
 // the pipe early. This covers the ASYNC path — an 'error' event emitted on the
 // stream. The SYNCHRONOUS path (a `write EPIPE` thrown straight out of
@@ -214,6 +215,9 @@ registerOutpostsCommand(program);
 // mint a shareable Stripe card-capture link — the client side of the paid-
 // provisioning gate for agents & Outposts.
 registerBillingCommand(program);
+program.hook("preAction", async () => {
+    await emitCliSessionStarted();
+});
 export async function runCli() {
     try {
         Sentry.addBreadcrumb({
@@ -274,4 +278,4 @@ export async function runCli() {
     }
 }
 //# sourceMappingURL=main.js.map
-//# debugId=1cc9f0b6-d8a8-54ea-a85f-44437f67b856
+//# debugId=d6747715-2057-5a0c-bfc5-c0a8372639d0

package/dist/utils/cli-telemetry.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Emit the authenticated CLI session signal using an already-cached token.
+ * This deliberately never refreshes a session or opens a browser.
+ */
+export declare function emitCliSessionStarted(): Promise<void>;
+//# sourceMappingURL=cli-telemetry.d.ts.map

package/dist/utils/cli-telemetry.js

@@ -0,0 +1,60 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b7441453-1b37-541f-becb-a3ccb3a554cf")}catch(e){}}();
+import { CLI_VERSION } from "../cli-version.js";
+import { isExpiring, isMachineIdentity, loadCachedTokens, } from "./cognito-session.js";
+import { vaultApiFetch } from "./vault-api.js";
+const TELEMETRY_TIMEOUT_MS = 1_200;
+let cliSessionStartedPromise;
+/**
+ * Emit the authenticated CLI session signal using an already-cached token.
+ * This deliberately never refreshes a session or opens a browser.
+ */
+export function emitCliSessionStarted() {
+    cliSessionStartedPromise ??= emitCachedCliSessionStarted();
+    return cliSessionStartedPromise;
+}
+async function emitCachedCliSessionStarted() {
+    try {
+        const cached = loadCachedTokens();
+        if (!cached || isExpiring(cached, 120))
+            return;
+        const token = isMachineIdentity() ? cached.idToken : cached.accessToken;
+        if (!token)
+            return;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), TELEMETRY_TIMEOUT_MS);
+        try {
+            const response = await vaultApiFetch({
+                token,
+                path: "/v1/telemetry/events",
+                method: "POST",
+                body: {
+                    events: [
+                        {
+                            eventName: "cli_session_started",
+                            app: "hq-cli",
+                            source: "cli",
+                            occurredAt: new Date().toISOString(),
+                            schemaVersion: 1,
+                            properties: { version: CLI_VERSION },
+                        },
+                    ],
+                },
+                signal: controller.signal,
+            });
+            if (!response.ok)
+                return;
+        }
+        catch {
+            // Telemetry is best effort and must never affect a CLI command.
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    catch {
+        // Cached-token reads are also best effort (for example, a malformed cache).
+    }
+}
+//# sourceMappingURL=cli-telemetry.js.map
+//# debugId=b7441453-1b37-541f-becb-a3ccb3a554cf

package/dist/utils/cognito-session.d.ts

@@ -18,7 +18,8 @@
  *   HQ_COGNITO_CALLBACK_PORT   — Loopback OAuth callback port
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
-import { type CognitoAuthConfig, type ClientInfo, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
+import { loadCachedTokens, isExpiring, isMachineIdentity, type CognitoAuthConfig, type ClientInfo, type VaultServiceConfig } from "@indigoai-us/hq-cloud";
+export { isExpiring, isMachineIdentity, loadCachedTokens };
 export declare const DEFAULT_COGNITO: CognitoAuthConfig;
 export declare const DEFAULT_VAULT_API_URL: string;
 /**

package/dist/utils/cognito-session.js

@@ -19,7 +19,7 @@
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f5342b2c-413d-5142-a44a-92788f273678")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5a2a53de-b1ef-5d31-891c-9f508b6e4d7a")}catch(e){}}();
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -27,6 +27,9 @@ import * as yaml from "js-yaml";
 import chalk from "chalk";
 import { loadCachedTokens, isExpiring, refreshTokens, browserLogin, detectHqCoreVersion, isMachineIdentity, getValidMachineTokens, } from "@indigoai-us/hq-cloud";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
+// Re-export the cached-session primitives for callers that must deliberately
+// avoid the refresh/login behavior in the higher-level helpers below.
+export { isExpiring, isMachineIdentity, loadCachedTokens };
 export const DEFAULT_COGNITO = {
     region: process.env.AWS_REGION ?? "us-east-1",
     userPoolDomain: process.env.HQ_COGNITO_DOMAIN ?? "vault-indigo-hq-prod",
@@ -375,4 +378,4 @@ export async function refreshCachedSession() {
     }
 }
 //# sourceMappingURL=cognito-session.js.map
-//# debugId=f5342b2c-413d-5142-a44a-92788f273678
+//# debugId=5a2a53de-b1ef-5d31-891c-9f508b6e4d7a

package/dist/utils/vault-api.d.ts

@@ -4,6 +4,7 @@ export interface VaultApiOptions {
     method?: string;
     body?: Record<string, unknown>;
     query?: Record<string, string>;
+    signal?: AbortSignal;
 }
 export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
 /**

package/dist/utils/vault-api.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="85e24f6f-4027-5b00-a4a4-b9a140897d7e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6f96bd3e-9a86-54ba-ad09-951c57afac62")}catch(e){}}();
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
 import { Sentry } from '../sentry.js';
 export async function vaultApiFetch(opts) {
@@ -24,6 +24,7 @@ export async function vaultApiFetch(opts) {
             'Content-Type': 'application/json',
         },
         body: opts.body ? JSON.stringify(opts.body) : undefined,
+        signal: opts.signal,
     });
     if (!response.ok) {
         Sentry.addBreadcrumb({
@@ -229,4 +230,4 @@ export async function getEntityUid(token, opts) {
     return getCompanyUid(token, opts.companySlug);
 }
 //# sourceMappingURL=vault-api.js.map
-//# debugId=85e24f6f-4027-5b00-a4a4-b9a140897d7e
+//# debugId=6f96bd3e-9a86-54ba-ad09-951c57afac62

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.68.2",
+  "version": "5.69.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {