@indigoai-us/hq-cli 5.75.0 → 5.77.0

package/src/commands/outposts.test.ts

@@ -45,8 +45,7 @@ vi.mock("@indigoai-us/hq-cloud", async (importOriginal) => {
 // The SSH fallback shells out to `ssh` via spawnSync — stub it so tests don't
 // touch a real box or need the ssh binary.
 vi.mock("node:child_process", async (importOriginal) => {
-  const original =
-    await importOriginal<typeof import("node:child_process")>();
+  const original = await importOriginal<typeof import("node:child_process")>();
   return { ...original, spawnSync: vi.fn() };
 });
 
@@ -173,7 +172,9 @@ describe("hq outposts codex-enable / login", () => {
   });
 
   it("login-code POSTs /outpost/login-code with the code in the body", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { ok: true, userId: "u1" }));
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { ok: true, userId: "u1" }),
+    );
     await run(["outposts", "login-code", "ABC-123"]);
     const [url, init] = fetchSpy.mock.calls[0];
     expect(String(url)).toContain("/outpost/login-code");
@@ -182,7 +183,9 @@ describe("hq outposts codex-enable / login", () => {
   });
 
   it("login-code targets a specific box via --id (outpostId query)", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { ok: true, userId: "u1" }));
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { ok: true, userId: "u1" }),
+    );
     await run(["outposts", "login-code", "CODE", "--id", "3"]);
     const [url] = fetchSpy.mock.calls[0];
     expect(String(url)).toContain("outpostId=3");
@@ -197,7 +200,11 @@ describe("hq outposts codex-enable / login", () => {
 
   it("login-code surfaces an awaiting-login not-found error", async () => {
     fetchSpy.mockResolvedValueOnce(
-      jsonResponse(404, { error: true, step: "not-found", message: "no outpost" }),
+      jsonResponse(404, {
+        error: true,
+        step: "not-found",
+        message: "no outpost",
+      }),
     );
     await expect(run(["outposts", "login-code", "CODE"])).rejects.toThrow(
       "process.exit(1)",
@@ -237,9 +244,9 @@ describe("hq outposts destroy", () => {
     fetchSpy.mockResolvedValueOnce(
       jsonResponse(500, { error: "boom", step: "teardown" }),
     );
-    await expect(
-      run(["outposts", "destroy", "--yes"]),
-    ).rejects.toThrow("process.exit(1)");
+    await expect(run(["outposts", "destroy", "--yes"])).rejects.toThrow(
+      "process.exit(1)",
+    );
   });
 });
 
@@ -267,6 +274,68 @@ describe("hq outposts provision (billing gate)", () => {
     expect(sent.agentRuntime).toBe("codex");
   });
 
+  it("rejects an unknown --runtime before the charge gate and makes NO API call", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    await expect(
+      run(["outposts", "provision", "--runtime", "codx", "--yes"]),
+    ).rejects.toThrow("process.exit(1)");
+    expect(fetchSpy).not.toHaveBeenCalled();
+    const printed = errSpy.mock.calls
+      .map((c) => c.map(String).join(" "))
+      .join("\n");
+    // A typo'd runtime must not silently resolve to claude — codex is the whole
+    // point of the flag, so a near-miss has to name itself.
+    expect(printed).toContain("codx");
+    expect(printed).toMatch(/claude/);
+    expect(printed).toMatch(/codex/);
+  });
+
+  it("accepts an explicit --runtime claude", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { ok: true }));
+    await run(["outposts", "provision", "--runtime", "claude", "--yes"]);
+    const sent = JSON.parse(fetchSpy.mock.calls[0][1]?.body as string);
+    expect(sent.agentRuntime).toBe("claude");
+  });
+
+  it("explains the per-person cap on a 409 rather than printing a bare 'Conflict'", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    // hq-pro's cap body carries `capped`/`limit`/`outposts` and NO
+    // `message`/`error` field, so the generic decoder falls through to
+    // res.statusText — the operator sees only "Conflict".
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(409, {
+        capped: true,
+        userId: "user_test_123",
+        limit: 1,
+        outposts: [
+          {
+            outpostId: "primary",
+            state: "ready",
+            instanceName: "outpost-user_test_123",
+            region: "us-east-1",
+            agentRuntime: "claude",
+            platform: "ec2",
+            createdAt: "2026-07-01T00:00:00.000Z",
+          },
+        ],
+      }),
+    );
+
+    await expect(run(["outposts", "provision", "--yes"])).rejects.toThrow(
+      "process.exit(1)",
+    );
+
+    const printed = errSpy.mock.calls
+      .map((c) => c.map(String).join(" "))
+      .join("\n");
+    expect(printed).not.toMatch(/^Conflict$/m);
+    expect(printed).toMatch(/limit/i);
+    // Name the box they already own, and reassure on the charge they were
+    // just warned about — the cap is checked BEFORE activation billing.
+    expect(printed).toContain("primary");
+    expect(printed).toMatch(/not been charged/i);
+  });
+
   it("mints a card-capture link on 402 billing_required and exits 1", async () => {
     fetchSpy
       .mockResolvedValueOnce(
@@ -286,9 +355,9 @@ describe("hq outposts provision (billing gate)", () => {
         jsonResponse(200, { url: "https://checkout.stripe.com/outpost" }),
       );
 
-    await expect(
-      run(["outposts", "provision", "--yes"]),
-    ).rejects.toThrow("process.exit(1)");
+    await expect(run(["outposts", "provision", "--yes"])).rejects.toThrow(
+      "process.exit(1)",
+    );
 
     expect(String(fetchSpy.mock.calls[1][0])).toContain(
       "/v1/billing/checkout/person",
@@ -296,6 +365,43 @@ describe("hq outposts provision (billing gate)", () => {
     const printed = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
     expect(printed).toContain("https://checkout.stripe.com/outpost");
   });
+
+  it("surfaces the DECLINE reason on 402 payment_failed — never the 'No card on file' copy", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    // hq-pro's payment_failed envelope: a card EXISTS and was declined. The
+    // server's `message` carries the friendly decline copy; telling this user
+    // "No card on file" sends them down the wrong remediation path entirely.
+    fetchSpy
+      .mockResolvedValueOnce(
+        jsonResponse(402, {
+          error: "payment required",
+          message: "Your card was declined. Try a different card or contact your bank.",
+          billing: {
+            status: "payment_failed",
+            setup: {
+              payerType: "person",
+              path: "/v1/billing/checkout/person",
+              method: "POST",
+            },
+          },
+        }),
+      )
+      .mockResolvedValueOnce(
+        jsonResponse(200, { url: "https://checkout.stripe.com/update-card" }),
+      );
+
+    await expect(run(["outposts", "provision", "--yes"])).rejects.toThrow(
+      "process.exit(1)",
+    );
+
+    const printed = [...errSpy.mock.calls, ...logSpy.mock.calls]
+      .map((c) => c.map(String).join(" "))
+      .join("\n");
+    expect(printed).toContain("declined");
+    expect(printed).not.toContain("No card on file");
+    // The card-capture link still surfaces — as the way to UPDATE the card.
+    expect(printed).toContain("https://checkout.stripe.com/update-card");
+  });
 });
 
 describe("hq outposts exec", () => {
@@ -394,12 +500,13 @@ describe("hq outposts exec", () => {
       jsonResponse(409, {
         error: true,
         step: "not-ready",
-        message: 'outpost is "provisioning", not ready — it must be running to exec',
+        message:
+          'outpost is "provisioning", not ready — it must be running to exec',
       }),
     );
-    await expect(
-      run(["outposts", "exec", "echo", "hi"]),
-    ).rejects.toThrow("process.exit(1)");
+    await expect(run(["outposts", "exec", "echo", "hi"])).rejects.toThrow(
+      "process.exit(1)",
+    );
   });
 
   it("emits raw JSON with --json", async () => {
@@ -523,11 +630,15 @@ describe("hq outposts exec — Lightsail SSH fallback", () => {
 
   it("does NOT fall back for a non-platform error (e.g. not-ready)", async () => {
     fetchSpy.mockResolvedValueOnce(
-      jsonResponse(409, { error: true, step: "not-ready", message: "not ready" }),
+      jsonResponse(409, {
+        error: true,
+        step: "not-ready",
+        message: "not ready",
+      }),
+    );
+    await expect(run(["outposts", "exec", "echo", "hi"])).rejects.toThrow(
+      "process.exit(1)",
     );
-    await expect(
-      run(["outposts", "exec", "echo", "hi"]),
-    ).rejects.toThrow("process.exit(1)");
     // Only the SSM call happened; no ssh-access mint, no ssh.
     expect(fetchSpy).toHaveBeenCalledTimes(1);
     expect(mockSpawnSync).not.toHaveBeenCalled();
@@ -711,7 +822,9 @@ describe("hq outposts asynchronous exec", () => {
       expect.stringContaining("/outpost/exec?outpostId=2"),
       expect.stringContaining("/outpost/exec?outpostId=2"),
     ]);
-    expect(fetchSpy.mock.calls.map(([, init]) => JSON.parse(init?.body as string))).toEqual([
+    expect(
+      fetchSpy.mock.calls.map(([, init]) => JSON.parse(init?.body as string)),
+    ).toEqual([
       { mode: "stage" },
       { mode: "submit", command: "cd /tmp && run-worker" },
       { mode: "result", commandId: "cmd-1" },
@@ -738,7 +851,15 @@ describe("hq outposts asynchronous exec", () => {
       )
       .mockResolvedValueOnce(new Response(null, { status: 200 }));
 
-    await run(["outposts", "exec-stage", "--id", "2", "--file", file, "--json"]);
+    await run([
+      "outposts",
+      "exec-stage",
+      "--id",
+      "2",
+      "--file",
+      file,
+      "--json",
+    ]);
 
     expect(fetchSpy).toHaveBeenCalledTimes(2);
     const [uploadUrl, uploadInit] = fetchSpy.mock.calls[1];
@@ -748,7 +869,9 @@ describe("hq outposts asynchronous exec", () => {
       "Content-Length": String(expectedBytes.byteLength),
     });
     expect(Buffer.from(uploadInit?.body as Uint8Array)).toEqual(expectedBytes);
-    const printed = stdoutSpy.mock.calls.map((call) => String(call[0])).join("");
+    const printed = stdoutSpy.mock.calls
+      .map((call) => String(call[0]))
+      .join("");
     expect(JSON.parse(printed)).toEqual({
       key: "input-key",
       getUrl: "https://download.invalid/get",
@@ -828,6 +951,10 @@ describe("hq outposts asynchronous exec", () => {
     });
   });
 
+  // Spawns a real `bash` (execFileSync) to prove the round-trip end-to-end.
+  // Under the saturated full-suite parallel pool that spawn can exceed vitest's
+  // 5s default purely on scheduling contention; the extra budget covers that,
+  // not slow logic (isolated, this runs in milliseconds).
   it("preserves one command part verbatim and round-trips quoted bash argv", () => {
     const single = "  printf 'already formed'  ";
     expect(joinCommandParts([single])).toBe(single);
@@ -844,7 +971,7 @@ describe("hq outposts asynchronous exec", () => {
     expect(execFileSync("bash", ["-c", command], { encoding: "utf8" })).toBe(
       "marker\na b\nquote's\n",
     );
-  });
+  }, 30_000);
 
   it("exec-result --wait retries a 429, polls until done, and prints the result contract", async () => {
     vi.useFakeTimers();
@@ -854,7 +981,11 @@ describe("hq outposts asynchronous exec", () => {
         .mockImplementation(() => true);
       fetchSpy
         .mockResolvedValueOnce(
-          jsonResponse(429, { error: true, step: "rate", message: "slow down" }),
+          jsonResponse(429, {
+            error: true,
+            step: "rate",
+            message: "slow down",
+          }),
         )
         .mockResolvedValueOnce(
           jsonResponse(200, {