@indigoai-us/hq-cli 5.75.0 → 5.76.0

package/src/commands/mcp-registration.ts

@@ -1071,7 +1071,8 @@ function restoreSafely(realTarget: string, backupDir: string): boolean {
 //
 // SECRET SAFETY (the hard rule from the PRD authModel / US-002 AC):
 //   - `${secret:NAME}` resolves ONLY here, at emit, via the injected
-//     {@link SecretResolver} (production = the AES-256-GCM `secrets-cache.ts`).
+//     {@link SecretResolver}. Production injects values returned by a fresh
+//     server authorization; the encrypted disk cache is never a value fallback.
 //   - The RESOLVED value lands in `~/.claude.json` — a 0600 user-global file that
 //     is NOT synced/committed — because the runtime needs the real header to work.
 //   - The resolved value is REDACTED from every return value and never echoed; we
@@ -1105,11 +1106,10 @@ export interface McpManifest {
 /**
  * Resolve a `${secret:NAME}` reference to its plaintext value, or return `null`
  * when the secret is unavailable (un-minted / TTL-expired / no company context).
- * Production binds this to `secrets-cache.ts` (`readCache(companyUid, NAME)`,
- * AES-256-GCM, 0600, 5-min TTL); TESTS inject a pure map so they NEVER read the
- * real encrypted cache. Returning `null` for a referenced secret is a hard error
- * at emit (we refuse to write a broken header), distinct from a name with no
- * reference at all.
+ * Production binds this to an in-memory map populated by a fresh vault `/load`
+ * authorization response; tests inject a pure map. Returning `null` for a
+ * referenced secret is a hard error at emit (we refuse to write a broken
+ * header), distinct from a name with no reference at all.
  */
 export type SecretResolver = (name: string) => string | null;
 
@@ -1146,9 +1146,9 @@ export function resolveSecretRefs(
     const resolved = resolve(name);
     if (resolved === null || resolved === undefined) {
       throw new McpManifestError(
-        `cannot resolve \${secret:${name}} at emit — the secret is not in the cache ` +
-          '(mint it via the pack onboarding / `hq run`, then re-install). HQ refuses to ' +
-          'write a half-resolved header.',
+        `cannot resolve \${secret:${name}} at emit — the secret was not available ` +
+          'after online vault authorization (check login, company scope, and access, ' +
+          'then re-install). HQ refuses to write a half-resolved header.',
       );
     }
     if (resolved.length > 0) secretSink.add(resolved);

package/src/commands/outposts.test.ts

@@ -45,8 +45,7 @@ vi.mock("@indigoai-us/hq-cloud", async (importOriginal) => {
 // The SSH fallback shells out to `ssh` via spawnSync — stub it so tests don't
 // touch a real box or need the ssh binary.
 vi.mock("node:child_process", async (importOriginal) => {
-  const original =
-    await importOriginal<typeof import("node:child_process")>();
+  const original = await importOriginal<typeof import("node:child_process")>();
   return { ...original, spawnSync: vi.fn() };
 });
 
@@ -173,7 +172,9 @@ describe("hq outposts codex-enable / login", () => {
   });
 
   it("login-code POSTs /outpost/login-code with the code in the body", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { ok: true, userId: "u1" }));
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { ok: true, userId: "u1" }),
+    );
     await run(["outposts", "login-code", "ABC-123"]);
     const [url, init] = fetchSpy.mock.calls[0];
     expect(String(url)).toContain("/outpost/login-code");
@@ -182,7 +183,9 @@ describe("hq outposts codex-enable / login", () => {
   });
 
   it("login-code targets a specific box via --id (outpostId query)", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { ok: true, userId: "u1" }));
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { ok: true, userId: "u1" }),
+    );
     await run(["outposts", "login-code", "CODE", "--id", "3"]);
     const [url] = fetchSpy.mock.calls[0];
     expect(String(url)).toContain("outpostId=3");
@@ -197,7 +200,11 @@ describe("hq outposts codex-enable / login", () => {
 
   it("login-code surfaces an awaiting-login not-found error", async () => {
     fetchSpy.mockResolvedValueOnce(
-      jsonResponse(404, { error: true, step: "not-found", message: "no outpost" }),
+      jsonResponse(404, {
+        error: true,
+        step: "not-found",
+        message: "no outpost",
+      }),
     );
     await expect(run(["outposts", "login-code", "CODE"])).rejects.toThrow(
       "process.exit(1)",
@@ -237,9 +244,9 @@ describe("hq outposts destroy", () => {
     fetchSpy.mockResolvedValueOnce(
       jsonResponse(500, { error: "boom", step: "teardown" }),
     );
-    await expect(
-      run(["outposts", "destroy", "--yes"]),
-    ).rejects.toThrow("process.exit(1)");
+    await expect(run(["outposts", "destroy", "--yes"])).rejects.toThrow(
+      "process.exit(1)",
+    );
   });
 });
 
@@ -267,6 +274,68 @@ describe("hq outposts provision (billing gate)", () => {
     expect(sent.agentRuntime).toBe("codex");
   });
 
+  it("rejects an unknown --runtime before the charge gate and makes NO API call", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    await expect(
+      run(["outposts", "provision", "--runtime", "codx", "--yes"]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+    const printed = errSpy.mock.calls
+      .map((c) => c.map(String).join(" "))
+      .join("\n");
+    // A typo'd runtime must not silently resolve to claude — codex is the whole
+    // point of the flag, so a near-miss has to name itself.
+    expect(printed).toContain("codx");
+    expect(printed).toMatch(/claude/);
+    expect(printed).toMatch(/codex/);
+  });
+
+  it("accepts an explicit --runtime claude", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { ok: true }));
+    await run(["outposts", "provision", "--runtime", "claude", "--yes"]);
+    const sent = JSON.parse(fetchSpy.mock.calls[0][1]?.body as string);
+    expect(sent.agentRuntime).toBe("claude");
+  });
+
+  it("explains the per-person cap on a 409 rather than printing a bare 'Conflict'", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    // hq-pro's cap body carries `capped`/`limit`/`outposts` and NO
+    // `message`/`error` field, so the generic decoder falls through to
+    // res.statusText — the operator sees only "Conflict".
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(409, {
+        capped: true,
+        userId: "user_test_123",
+        limit: 1,
+        outposts: [
+          {
+            outpostId: "primary",
+            state: "ready",
+            instanceName: "outpost-user_test_123",
+            region: "us-east-1",
+            agentRuntime: "claude",
+            platform: "ec2",
+            createdAt: "2026-07-01T00:00:00.000Z",
+          },
+        ],
+      }),
+    );
+
+    await expect(run(["outposts", "provision", "--yes"])).rejects.toThrow(
+      "process.exit(1)",
+    );
+
+    const printed = errSpy.mock.calls
+      .map((c) => c.map(String).join(" "))
+      .join("\n");
+    expect(printed).not.toMatch(/^Conflict$/m);
+    expect(printed).toMatch(/limit/i);
+    // Name the box they already own, and reassure on the charge they were
+    // just warned about — the cap is checked BEFORE activation billing.
+    expect(printed).toContain("primary");
+    expect(printed).toMatch(/not been charged/i);
+  });
+
   it("mints a card-capture link on 402 billing_required and exits 1", async () => {
     fetchSpy
       .mockResolvedValueOnce(
@@ -286,9 +355,9 @@ describe("hq outposts provision (billing gate)", () => {
         jsonResponse(200, { url: "https://checkout.stripe.com/outpost" }),
       );
 
-    await expect(
-      run(["outposts", "provision", "--yes"]),
-    ).rejects.toThrow("process.exit(1)");
+    await expect(run(["outposts", "provision", "--yes"])).rejects.toThrow(
+      "process.exit(1)",
+    );
 
     expect(String(fetchSpy.mock.calls[1][0])).toContain(
       "/v1/billing/checkout/person",
@@ -394,12 +463,13 @@ describe("hq outposts exec", () => {
       jsonResponse(409, {
         error: true,
         step: "not-ready",
-        message: 'outpost is "provisioning", not ready — it must be running to exec',
+        message:
+          'outpost is "provisioning", not ready — it must be running to exec',
       }),
     );
-    await expect(
-      run(["outposts", "exec", "echo", "hi"]),
-    ).rejects.toThrow("process.exit(1)");
+    await expect(run(["outposts", "exec", "echo", "hi"])).rejects.toThrow(
+      "process.exit(1)",
+    );
   });
 
   it("emits raw JSON with --json", async () => {
@@ -523,11 +593,15 @@ describe("hq outposts exec — Lightsail SSH fallback", () => {
 
   it("does NOT fall back for a non-platform error (e.g. not-ready)", async () => {
     fetchSpy.mockResolvedValueOnce(
-      jsonResponse(409, { error: true, step: "not-ready", message: "not ready" }),
+      jsonResponse(409, {
+        error: true,
+        step: "not-ready",
+        message: "not ready",
+      }),
+    );
+    await expect(run(["outposts", "exec", "echo", "hi"])).rejects.toThrow(
+      "process.exit(1)",
     );
-    await expect(
-      run(["outposts", "exec", "echo", "hi"]),
-    ).rejects.toThrow("process.exit(1)");
     // Only the SSM call happened; no ssh-access mint, no ssh.
     expect(fetchSpy).toHaveBeenCalledTimes(1);
     expect(mockSpawnSync).not.toHaveBeenCalled();
@@ -711,7 +785,9 @@ describe("hq outposts asynchronous exec", () => {
       expect.stringContaining("/outpost/exec?outpostId=2"),
       expect.stringContaining("/outpost/exec?outpostId=2"),
     ]);
-    expect(fetchSpy.mock.calls.map(([, init]) => JSON.parse(init?.body as string))).toEqual([
+    expect(
+      fetchSpy.mock.calls.map(([, init]) => JSON.parse(init?.body as string)),
+    ).toEqual([
       { mode: "stage" },
       { mode: "submit", command: "cd /tmp && run-worker" },
       { mode: "result", commandId: "cmd-1" },
@@ -738,7 +814,15 @@ describe("hq outposts asynchronous exec", () => {
       )
       .mockResolvedValueOnce(new Response(null, { status: 200 }));
 
-    await run(["outposts", "exec-stage", "--id", "2", "--file", file, "--json"]);
+    await run([
+      "outposts",
+      "exec-stage",
+      "--id",
+      "2",
+      "--file",
+      file,
+      "--json",
+    ]);
 
     expect(fetchSpy).toHaveBeenCalledTimes(2);
     const [uploadUrl, uploadInit] = fetchSpy.mock.calls[1];
@@ -748,7 +832,9 @@ describe("hq outposts asynchronous exec", () => {
       "Content-Length": String(expectedBytes.byteLength),
     });
     expect(Buffer.from(uploadInit?.body as Uint8Array)).toEqual(expectedBytes);
-    const printed = stdoutSpy.mock.calls.map((call) => String(call[0])).join("");
+    const printed = stdoutSpy.mock.calls
+      .map((call) => String(call[0]))
+      .join("");
     expect(JSON.parse(printed)).toEqual({
       key: "input-key",
       getUrl: "https://download.invalid/get",
@@ -828,6 +914,10 @@ describe("hq outposts asynchronous exec", () => {
     });
   });
 
+  // Spawns a real `bash` (execFileSync) to prove the round-trip end-to-end.
+  // Under the saturated full-suite parallel pool that spawn can exceed vitest's
+  // 5s default purely on scheduling contention; the extra budget covers that,
+  // not slow logic (isolated, this runs in milliseconds).
   it("preserves one command part verbatim and round-trips quoted bash argv", () => {
     const single = "  printf 'already formed'  ";
     expect(joinCommandParts([single])).toBe(single);
@@ -844,7 +934,7 @@ describe("hq outposts asynchronous exec", () => {
     expect(execFileSync("bash", ["-c", command], { encoding: "utf8" })).toBe(
       "marker\na b\nquote's\n",
     );
-  });
+  }, 30_000);
 
   it("exec-result --wait retries a 429, polls until done, and prints the result contract", async () => {
     vi.useFakeTimers();
@@ -854,7 +944,11 @@ describe("hq outposts asynchronous exec", () => {
         .mockImplementation(() => true);
       fetchSpy
         .mockResolvedValueOnce(
-          jsonResponse(429, { error: true, step: "rate", message: "slow down" }),
+          jsonResponse(429, {
+            error: true,
+            step: "rate",
+            message: "slow down",
+          }),
         )
         .mockResolvedValueOnce(
           jsonResponse(200, {