@indigoai-us/hq-cli 5.71.0 → 5.72.0

package/dist/utils/sentry-identity.js

@@ -1,5 +1,3 @@
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1ca7cb4e-47e2-5cd0-a400-bbdaafa2b0d5")}catch(e){}}();
 import { loadCachedTokens, isMachineIdentity, loadMachineCreds, } from "@indigoai-us/hq-cloud";
 /** Decode the (untrusted) id-token payload — for attribution/display only. */
 function peekIdToken(idToken) {
@@ -39,5 +37,4 @@ export function getCachedSentryUser() {
         return null;
     }
 }
-//# sourceMappingURL=sentry-identity.js.map
-//# debugId=1ca7cb4e-47e2-5cd0-a400-bbdaafa2b0d5
+//# sourceMappingURL=sentry-identity.js.map

package/dist/utils/vault-api.js

@@ -1,5 +1,3 @@
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6f96bd3e-9a86-54ba-ad09-951c57afac62")}catch(e){}}();
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
 import { Sentry } from '../sentry.js';
 export async function vaultApiFetch(opts) {
@@ -229,5 +227,4 @@ export async function getEntityUid(token, opts) {
     }
     return getCompanyUid(token, opts.companySlug);
 }
-//# sourceMappingURL=vault-api.js.map
-//# debugId=6f96bd3e-9a86-54ba-ad09-951c57afac62
+//# sourceMappingURL=vault-api.js.map

package/dist/utils/version-check.js

@@ -1,5 +1,3 @@
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f7058fc6-251e-5e11-af6c-de15f6e256f3")}catch(e){}}();
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -152,5 +150,4 @@ export const __test__ = {
     CACHE_TTL_MS,
     isKnownNoninteractiveStatusProbe,
 };
-//# sourceMappingURL=version-check.js.map
-//# debugId=f7058fc6-251e-5e11-af6c-de15f6e256f3
+//# sourceMappingURL=version-check.js.map

package/dist/utils/version-gate.js

@@ -27,8 +27,6 @@
  * Opt-out: `HQ_NO_UPDATE_CHECK=1` (same env as `version-check.ts` — one knob
  * to silence both check + gate).
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="00fa2aa9-f5d1-57a7-92db-c441c6bef906")}catch(e){}}();
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import path from "node:path";
@@ -278,5 +276,4 @@ export const __test__ = {
     runUpdateCommand,
     resolveRunningPrefix,
 };
-//# sourceMappingURL=version-gate.js.map
-//# debugId=00fa2aa9-f5d1-57a7-92db-c441c6bef906
+//# sourceMappingURL=version-gate.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.71.0",
+  "version": "5.72.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -8,7 +8,8 @@
     "hq-auth-refresh": "dist/bin/hq-auth-refresh.js"
   },
   "scripts": {
-    "build": "node scripts/generate-dsn.mjs && tsc",
+    "build": "node scripts/generate-dsn.mjs && tsc && node scripts/chmod-bins.mjs",
+    "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
     "test": "vitest run",

package/scripts/chmod-bins.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * Make every declared `bin` executable after `tsc` emits it.
+ *
+ * WHY: the build is plain `tsc`, and TypeScript does NOT set the executable
+ * bit on its output — `dist/index.js` lands as 0644 despite carrying a
+ * `#!/usr/bin/env node` shebang. Most `npm install` paths re-chmod bin targets
+ * to 0755 while linking, but not all do: a root global install on a fresh
+ * Amazon Linux outpost (`npm install -g @indigoai-us/hq-cli`) has been observed
+ * to leave the linked target at 0644, so `/usr/bin/hq` resolves to a
+ * non-executable file and EVERY `hq …` invocation on the box dies with
+ * "Permission denied" — the outpost never becomes CLI-ready.
+ *
+ * Fixing it here means the published tarball ships its bins already 0755, so
+ * the runnable bit no longer depends on the installer re-chmod'ing. Runs from
+ * `build` (local + CI) and `prepublishOnly` (guarantees a fresh publish is
+ * always executable, whatever state the publisher's dist was in).
+ *
+ * Cross-platform: uses fs.chmod (no `chmod` shell dependency); a no-op on
+ * Windows where the mode bits are ignored anyway.
+ */
+import { chmodSync, existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgPath = resolve(here, "..", "package.json");
+const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+
+const bins =
+  typeof pkg.bin === "string"
+    ? { [pkg.name]: pkg.bin }
+    : (pkg.bin ?? {});
+
+let touched = 0;
+for (const [name, relPath] of Object.entries(bins)) {
+  const target = resolve(here, "..", relPath);
+  if (!existsSync(target)) {
+    // Build not run yet / stale bin map — surface it loudly so a publish that
+    // would ship a missing bin fails fast instead of silently.
+    console.error(`chmod-bins: declared bin "${name}" not found at ${relPath}`);
+    process.exitCode = 1;
+    continue;
+  }
+  chmodSync(target, 0o755);
+  touched += 1;
+}
+
+console.log(`chmod-bins: made ${touched} bin(s) executable (0755)`);

package/src/commands/outposts-replica-sync.test.ts

@@ -0,0 +1,272 @@
+import { Command } from "commander";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+  type MockInstance,
+} from "vitest";
+import {
+  parseReposManifest,
+  registerOutpostsCommand,
+  type ReplicaSyncDependencies,
+} from "./outposts.js";
+
+const HQ_ROOT = "/home/ec2-user/hq";
+const SECRET = "refresh-token-that-must-never-be-printed";
+
+const REPOS_YAML = `repos:
+  - url: https://github.com/indigoai-us/hq-pro.git
+    visibility: private
+    name: hq-pro
+  - url: https://github.com/indigoai-us/public-widget.git
+    visibility: public
+  - url: https://github.com/indigoai-us/hq-cli.git
+    visibility: private
+    name: hq-cli
+`;
+
+type SpawnCall = {
+  command: string;
+  args: string[];
+  options: Parameters<ReplicaSyncDependencies["spawnSync"]>[2];
+};
+
+function ok(stdout = "") {
+  return {
+    status: 0,
+    stdout,
+    stderr: "",
+    error: undefined,
+  } as ReturnType<ReplicaSyncDependencies["spawnSync"]>;
+}
+
+function replicaDependencies(input: {
+  session?: { refreshToken?: string; idToken?: string } | undefined;
+  reposYaml?: string | null;
+  existing?: Set<string>;
+  failRescue?: boolean;
+  failAuthRefresh?: boolean;
+} = {}): {
+  deps: Partial<ReplicaSyncDependencies>;
+  calls: SpawnCall[];
+  mkdirp: MockInstance;
+} {
+  const calls: SpawnCall[] = [];
+  const existing = input.existing ?? new Set<string>();
+  const mkdirp = vi.fn();
+  const deps: Partial<ReplicaSyncDependencies> = {
+    defaultHqRoot: () => HQ_ROOT,
+    loadCachedTokens: () =>
+      "session" in input ? input.session : { refreshToken: SECRET },
+    readTextFile: (file: string) => {
+      if (file.endsWith("repos.yaml")) {
+        if (input.reposYaml === null) throw new Error("ENOENT");
+        return input.reposYaml ?? REPOS_YAML;
+      }
+      throw new Error(`unexpected readTextFile(${file})`);
+    },
+    pathExists: (p: string) => existing.has(p),
+    mkdirp: mkdirp as unknown as ReplicaSyncDependencies["mkdirp"],
+    spawnSync: ((command, args, options) => {
+      calls.push({ command, args, options });
+      if (input.failRescue && command === "hq" && args[0] === "rescue") {
+        return { ...ok(), status: 1 };
+      }
+      if (
+        input.failAuthRefresh &&
+        command === "hq" &&
+        args[0] === "auth" &&
+        args[1] === "refresh"
+      ) {
+        return { ...ok(), status: 1 };
+      }
+      return ok();
+    }) as ReplicaSyncDependencies["spawnSync"],
+  };
+  return { deps, calls, mkdirp };
+}
+
+function buildProgram(deps: Partial<ReplicaSyncDependencies>): Command {
+  const program = new Command();
+  program.name("hq").exitOverride();
+  registerOutpostsCommand(program, deps);
+  return program;
+}
+
+async function run(
+  deps: Partial<ReplicaSyncDependencies>,
+  args: string[],
+): Promise<void> {
+  await buildProgram(deps).parseAsync(["node", "hq", ...args]);
+}
+
+let logSpy: MockInstance<typeof console.log>;
+let warnSpy: MockInstance<typeof console.warn>;
+let fetchSpy: MockInstance<typeof fetch>;
+
+beforeEach(() => {
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+  warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+  fetchSpy = vi.spyOn(globalThis, "fetch");
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function printed(): string {
+  return [
+    ...logSpy.mock.calls.map((c) => c.map(String).join(" ")),
+    ...warnSpy.mock.calls.map((c) => c.map(String).join(" ")),
+  ].join("\n");
+}
+
+function hqArgs(calls: SpawnCall[]): string[][] {
+  return calls.filter((c) => c.command === "hq").map((c) => c.args);
+}
+
+describe("parseReposManifest", () => {
+  it("resolves visibility + name, defaulting to public + URL basename", () => {
+    expect(parseReposManifest(REPOS_YAML)).toEqual([
+      { url: "https://github.com/indigoai-us/hq-pro.git", visibility: "private", name: "hq-pro" },
+      { url: "https://github.com/indigoai-us/public-widget.git", visibility: "public", name: "public-widget" },
+      { url: "https://github.com/indigoai-us/hq-cli.git", visibility: "private", name: "hq-cli" },
+    ]);
+  });
+
+  it("returns [] for junk, empty, or repo-less YAML", () => {
+    expect(parseReposManifest("not: valid: [")).toEqual([]);
+    expect(parseReposManifest("")).toEqual([]);
+    expect(parseReposManifest("other: 1")).toEqual([]);
+  });
+
+  it("skips entries with no url", () => {
+    expect(parseReposManifest("repos:\n  - visibility: public\n  - url: https://x/y.git")).toEqual([
+      { url: "https://x/y.git", visibility: "public", name: "y" },
+    ]);
+  });
+
+  it("rejects names that would escape repos/<visibility>/ (path traversal)", () => {
+    const yaml =
+      "repos:\n" +
+      "  - url: https://x/evil.git\n    name: ../../etc\n" +
+      "  - url: https://x/evil2.git\n    name: sub/dir\n" +
+      "  - url: https://x/ok.git\n    name: ok\n";
+    expect(parseReposManifest(yaml)).toEqual([
+      { url: "https://x/ok.git", visibility: "public", name: "ok" },
+    ]);
+  });
+});
+
+describe("hq outposts replica-sync", () => {
+  it("is hidden from outposts help but remains invokable", async () => {
+    const { deps } = replicaDependencies();
+    const program = buildProgram(deps);
+    const outposts = program.commands.find((c) => c.name() === "outposts");
+    expect(outposts?.helpInformation()).not.toContain("replica-sync");
+    await run(deps, ["outposts", "replica-sync"]);
+  });
+
+  it("no HQ session → replicates nothing and runs no commands", async () => {
+    const { deps, calls } = replicaDependencies({ session: undefined });
+    await run(deps, ["outposts", "replica-sync"]);
+    expect(calls).toEqual([]);
+    expect(printed()).toContain("nothing to replicate");
+  });
+
+  it("runs the full replica chain in order on a signed-in box", async () => {
+    const { deps, calls, mkdirp } = replicaDependencies();
+    await run(deps, ["outposts", "replica-sync"]);
+
+    const args = hqArgs(calls);
+    expect(args).toContainEqual(["auth", "refresh"]);
+    // The pull is pinned to the SAME --hq-root the command was invoked with,
+    // not the default root.
+    expect(args).toContainEqual([
+      "sync",
+      "pull",
+      "--personal",
+      "--hq-root",
+      HQ_ROOT,
+      "--on-conflict",
+      "keep",
+    ]);
+    expect(args).toContainEqual(["rescue", "--hq-root", HQ_ROOT, "--yes"]);
+    // rescue needs companies/ to pre-exist.
+    expect(mkdirp).toHaveBeenCalledWith(`${HQ_ROOT}/companies`);
+  });
+
+  it("clones only the missing repos, gh-authing via the vault for privates", async () => {
+    const { deps, calls } = replicaDependencies({
+      // hq-cli already present → should be skipped.
+      existing: new Set([`${HQ_ROOT}/repos/private/hq-cli/.git`]),
+    });
+    await run(deps, ["outposts", "replica-sync"]);
+
+    const clones = calls
+      .filter((c) => c.command === "git" && c.args[0] === "clone")
+      .map((c) => c.args[c.args.length - 1]);
+    expect(clones).toContain(`${HQ_ROOT}/repos/private/hq-pro`);
+    expect(clones).toContain(`${HQ_ROOT}/repos/public/public-widget`);
+    expect(clones).not.toContain(`${HQ_ROOT}/repos/private/hq-cli`);
+
+    // A private repo is missing → gh auth flows through the vault (token in ENV,
+    // never argv).
+    const vaultAuth = calls.find(
+      (c) => c.command === "hq" && c.args[0] === "secrets" && c.args.includes("GITHUB_TOKEN"),
+    );
+    expect(vaultAuth).toBeTruthy();
+    expect(vaultAuth?.args).toContain("--personal");
+    expect(vaultAuth?.args).toContain("--only");
+  });
+
+  it("skips the vault gh auth when every missing repo is public", async () => {
+    const { deps, calls } = replicaDependencies({
+      reposYaml: "repos:\n  - url: https://github.com/x/pub.git\n    visibility: public\n",
+    });
+    await run(deps, ["outposts", "replica-sync"]);
+    const vaultAuth = calls.find((c) => c.command === "hq" && c.args[0] === "secrets");
+    expect(vaultAuth).toBeUndefined();
+  });
+
+  it("no repos.yaml → skips the clone step without error", async () => {
+    const { deps, calls } = replicaDependencies({ reposYaml: null });
+    await run(deps, ["outposts", "replica-sync"]);
+    expect(calls.some((c) => c.command === "git")).toBe(false);
+    expect(printed()).toContain("skipping repo clone");
+  });
+
+  it("aborts the cycle when auth refresh fails — no pull, rescue, or clone", async () => {
+    const { deps, calls } = replicaDependencies({ failAuthRefresh: true });
+    await run(deps, ["outposts", "replica-sync"]);
+    const args = hqArgs(calls);
+    expect(args).toContainEqual(["auth", "refresh"]);
+    expect(args.some((a) => a[0] === "sync")).toBe(false);
+    expect(args.some((a) => a[0] === "rescue")).toBe(false);
+    expect(calls.some((c) => c.command === "git")).toBe(false);
+    expect(printed()).toContain("auth refresh failed");
+  });
+
+  it("a failed step never throws or hard-fails the unit", async () => {
+    const { deps } = replicaDependencies({ failRescue: true });
+    await expect(run(deps, ["outposts", "replica-sync"])).resolves.toBeUndefined();
+    expect(printed()).toContain("HQ kernel rescue did not complete cleanly");
+  });
+
+  it("never leaks the session token or makes hq-pro requests", async () => {
+    const { deps, calls } = replicaDependencies();
+    await run(deps, ["outposts", "replica-sync"]);
+    expect(JSON.stringify(calls)).not.toContain(SECRET);
+    expect(printed()).not.toContain(SECRET);
+    expect(fetchSpy).not.toHaveBeenCalled();
+    // The GITHUB_TOKEN never appears as a bare argv value — only the var name
+    // inside the bash script and the --only selector.
+    const bashScripts = calls
+      .filter((c) => c.command === "hq" && c.args.includes("bash"))
+      .flatMap((c) => c.args);
+    expect(bashScripts.some((a) => a.includes("gh auth login --with-token"))).toBe(true);
+  });
+});