@indigoai-us/hq-cli 5.75.0 → 5.77.0

package/src/commands/outposts.ts

@@ -37,27 +37,55 @@ import {
   OUTPOST_PRICE_CENTS,
   confirmChargeOrExit,
   parseBillingPayload,
-  surfaceBillingRequired,
+  surfaceBillingBlocked,
   type BillingErrorPayload,
 } from "../utils/billing-gate.js";
 
+/**
+ * hq-pro's per-person cap envelope on a `409` provision block. Unlike every
+ * other `/outpost/*` failure this body carries NO `message`/`error` field —
+ * only the cap facts — so it has to be decoded structurally or the reason
+ * degrades to a bare `res.statusText` ("Conflict").
+ */
+export interface OutpostCappedPayload {
+  limit: number;
+  outposts: OutpostSummary[];
+}
+
+/** Decode hq-pro's `{ capped, limit, outposts }` cap envelope, if present. */
+export function parseCappedPayload(
+  body: unknown,
+): OutpostCappedPayload | undefined {
+  if (!body || typeof body !== "object") return undefined;
+  const b = body as { capped?: unknown; limit?: unknown; outposts?: unknown };
+  if (b.capped !== true) return undefined;
+  return {
+    limit: typeof b.limit === "number" ? b.limit : 0,
+    outposts: Array.isArray(b.outposts) ? (b.outposts as OutpostSummary[]) : [],
+  };
+}
+
 /** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
 export class OutpostHttpError extends Error {
   status: number;
   step?: string;
   /** hq-pro's billing envelope on a `402 billing_required` provision block. */
   billing?: BillingErrorPayload;
+  /** hq-pro's cap envelope on a `409` provision block. */
+  capped?: OutpostCappedPayload;
   constructor(
     status: number,
     message: string,
     step?: string,
     billing?: BillingErrorPayload,
+    capped?: OutpostCappedPayload,
   ) {
     super(message);
     this.name = "OutpostHttpError";
     this.status = status;
     this.step = step;
     this.billing = billing;
+    this.capped = capped;
   }
 }
 
@@ -105,6 +133,7 @@ export async function outpostRequest<T>(opts: {
       message,
       body.step,
       parseBillingPayload(body),
+      parseCappedPayload(body),
     );
   }
   return (await res.json()) as T;
@@ -113,9 +142,11 @@ export async function outpostRequest<T>(opts: {
 /**
  * Provision the caller's Outpost. Sends the cached Cognito refresh token so the
  * box can authenticate AS the caller (the same body the console's
- * `provisionMyOutpost` sends). Idempotent server-side: a caller already at their
- * per-person cap gets their existing box back rather than a duplicate. The
- * refresh token is sent over HTTPS and NEVER printed.
+ * `provisionMyOutpost` sends). No duplicate is ever created: a caller already at
+ * their per-person cap gets a `409` whose body lists their existing boxes —
+ * thrown here as an `OutpostHttpError` carrying `capped` (hq-pro checks the cap
+ * BEFORE activation billing, so a capped call is never charged). The refresh
+ * token is sent over HTTPS and NEVER printed.
  */
 export async function provisionOutpost(
   token: string,
@@ -480,6 +511,31 @@ function ensureTrailingNewline(s: string): string {
 // Command registration
 // ---------------------------------------------------------------------------
 
+/**
+ * Explain a `409` per-person cap. hq-pro checks the cap BEFORE activation
+ * billing, so nothing was charged — worth saying, since the caller just
+ * confirmed a recurring charge to get here.
+ */
+function surfaceOutpostCapped(capped: OutpostCappedPayload): void {
+  const owned = capped.outposts.length;
+  console.error(
+    chalk.yellow(
+      `You're already at your Outpost limit (${owned} of ${capped.limit}). ` +
+        `No new box was provisioned and you have not been charged.`,
+    ),
+  );
+  for (const o of capped.outposts) {
+    const detail = [o.state, o.instanceName, o.region]
+      .filter(Boolean)
+      .join("  ");
+    console.error(`  ${o.outpostId}  ${detail}`);
+  }
+  console.error(chalk.dim("Inspect it: hq outposts status"));
+  console.error(
+    chalk.dim("Or tear it down first: hq outposts destroy --id <id> --yes"),
+  );
+}
+
 function fail(err: unknown): never {
   if (err instanceof OutpostHttpError) {
     console.error(chalk.red(err.message));
@@ -513,8 +569,7 @@ export interface SelfDeployDependencies {
   ) => ReturnType<typeof spawnSync>;
   readTextFile: (file: string) => string;
   loadCachedTokens: () =>
-    | { refreshToken?: string; idToken?: string }
-    | undefined;
+    { refreshToken?: string; idToken?: string } | undefined;
   getUid: () => number | undefined;
   isStdinTty: () => boolean;
   confirm: () => Promise<boolean>;
@@ -595,10 +650,9 @@ function hqIdentityFromSession(session: {
   try {
     const payload = session.idToken.split(".")[1];
     if (!payload) return "your cached HQ session";
-    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as Record<
-      string,
-      unknown
-    >;
+    const claims = JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8"),
+    ) as Record<string, unknown>;
     for (const key of [
       "email",
       "preferred_username",
@@ -698,9 +752,10 @@ function runPrivileged(
   runChecked(deps, "sudo", [command, ...args], description, options);
 }
 
-function selfDeployPreflight(
-  deps: SelfDeployDependencies,
-): { refreshToken?: string; idToken?: string } {
+function selfDeployPreflight(deps: SelfDeployDependencies): {
+  refreshToken?: string;
+  idToken?: string;
+} {
   let osRelease: string;
   try {
     osRelease = deps.readTextFile("/etc/os-release");
@@ -740,7 +795,9 @@ function selfDeployPreflight(
 
   const session = deps.loadCachedTokens();
   if (!session?.refreshToken) {
-    throw selfDeployError("no HQ login session was found. Run `hq login`, then re-run this command.");
+    throw selfDeployError(
+      "no HQ login session was found. Run `hq login`, then re-run this command.",
+    );
   }
   return session;
 }
@@ -763,7 +820,9 @@ async function selfDeployOutpost(
       ),
     );
     if (!deps.isStdinTty()) {
-      throw new Error("Confirmation requires a TTY. Pass --yes to continue non-interactively.");
+      throw new Error(
+        "Confirmation requires a TTY. Pass --yes to continue non-interactively.",
+      );
     }
     if (!(await deps.confirm())) {
       throw new Error("Self-deploy cancelled.");
@@ -806,12 +865,7 @@ async function selfDeployOutpost(
       stdio: ["pipe", "ignore", "pipe"],
     },
   );
-  runPrivileged(
-    deps,
-    "systemctl",
-    ["daemon-reload"],
-    "Reloading systemd",
-  );
+  runPrivileged(deps, "systemctl", ["daemon-reload"], "Reloading systemd");
   runPrivileged(
     deps,
     "systemctl",
@@ -819,9 +873,19 @@ async function selfDeployOutpost(
     "Enabling outpost-sync.service",
   );
 
-  console.log(chalk.green("This box is now a self-hosted HQ outpost and will sync all your company vaults continuously."));
-  console.log(chalk.dim("Check it with: systemctl status outpost-sync.service"));
-  console.log(chalk.dim("It is unregistered and unmanaged by hq-pro (no console entry or remote management)."));
+  console.log(
+    chalk.green(
+      "This box is now a self-hosted HQ outpost and will sync all your company vaults continuously.",
+    ),
+  );
+  console.log(
+    chalk.dim("Check it with: systemctl status outpost-sync.service"),
+  );
+  console.log(
+    chalk.dim(
+      "It is unregistered and unmanaged by hq-pro (no console entry or remote management).",
+    ),
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -940,7 +1004,9 @@ function runBestEffort(
     return false;
   }
   if (!result || result.error || result.status !== 0) {
-    console.warn(`replica-sync: ${description} did not complete cleanly — continuing.`);
+    console.warn(
+      `replica-sync: ${description} did not complete cleanly — continuing.`,
+    );
     return false;
   }
   return true;
@@ -961,7 +1027,17 @@ function authGitHubViaVault(deps: ReplicaSyncDependencies): void {
   const authed = runBestEffort(
     deps,
     "hq",
-    ["secrets", "--personal", "exec", "--only", "GITHUB_TOKEN", "--", "bash", "-c", ghLogin],
+    [
+      "secrets",
+      "--personal",
+      "exec",
+      "--only",
+      "GITHUB_TOKEN",
+      "--",
+      "bash",
+      "-c",
+      ghLogin,
+    ],
     "GitHub auth via vault",
   );
   if (authed) {
@@ -978,7 +1054,9 @@ function replicateRepos(deps: ReplicaSyncDependencies, hqRoot: string): void {
   try {
     manifestText = deps.readTextFile(manifestPath);
   } catch {
-    console.log("replica-sync: no personal/data/repos.yaml — skipping repo clone.");
+    console.log(
+      "replica-sync: no personal/data/repos.yaml — skipping repo clone.",
+    );
     return;
   }
 
@@ -990,7 +1068,9 @@ function replicateRepos(deps: ReplicaSyncDependencies, hqRoot: string): void {
 
   const missing = repos.filter(
     (repo) =>
-      !deps.pathExists(path.join(hqRoot, "repos", repo.visibility, repo.name, ".git")),
+      !deps.pathExists(
+        path.join(hqRoot, "repos", repo.visibility, repo.name, ".git"),
+      ),
   );
   if (missing.length === 0) {
     console.log("replica-sync: all repos already present.");
@@ -1025,7 +1105,9 @@ async function replicaSyncOutpost(
   // signed in has nothing to pull — exit cleanly so the timer stays green.
   const session = deps.loadCachedTokens();
   if (!session?.refreshToken) {
-    console.log("replica-sync: no HQ session on this box yet — nothing to replicate.");
+    console.log(
+      "replica-sync: no HQ session on this box yet — nothing to replicate.",
+    );
     return;
   }
 
@@ -1041,7 +1123,15 @@ async function replicaSyncOutpost(
   runBestEffort(
     deps,
     "hq",
-    ["sync", "pull", "--personal", "--hq-root", hqRoot, "--on-conflict", "keep"],
+    [
+      "sync",
+      "pull",
+      "--personal",
+      "--hq-root",
+      hqRoot,
+      "--on-conflict",
+      "keep",
+    ],
     "personal vault pull",
   );
 
@@ -1088,7 +1178,11 @@ export function registerOutpostsCommand(
     .description(
       "Replicate your full HQ onto this box (personal pull + core rescue + repos). Runs on a timer.",
     )
-    .option("--hq-root <path>", "HQ root to replicate into", deps.defaultHqRoot())
+    .option(
+      "--hq-root <path>",
+      "HQ root to replicate into",
+      deps.defaultHqRoot(),
+    )
     .action(async (opts: { hqRoot?: string }) => {
       // Best-effort background job: never hard-fail the systemd unit on a
       // transient step. Swallow, log, and exit 0.
@@ -1105,7 +1199,10 @@ export function registerOutpostsCommand(
     .command("provision")
     .alias("create")
     .description("Provision a new Outpost ($80/month — requires --yes)")
-    .option("--runtime <runtime>", "Agent runtime: claude | codex (default claude)")
+    .option(
+      "--runtime <runtime>",
+      "Agent runtime: claude | codex (default claude)",
+    )
     .option("--disk <gb>", "Root disk size in GB (EC2 only)")
     .option(
       "--client-ip <ip>",
@@ -1114,20 +1211,43 @@ export function registerOutpostsCommand(
     .option("--yes", "Confirm the $80/month charge (required to provision)")
     .action(async function (
       this: Command,
-      opts: { runtime?: string; disk?: string; clientIp?: string; yes?: boolean },
+      opts: {
+        runtime?: string;
+        disk?: string;
+        clientIp?: string;
+        yes?: boolean;
+      },
     ) {
       try {
+        // Reject an unrecognized runtime rather than resolving it to claude:
+        // `--runtime codx` would otherwise hand back a silently Claude box.
+        if (
+          opts.runtime !== undefined &&
+          opts.runtime !== "claude" &&
+          opts.runtime !== "codex"
+        ) {
+          console.error(
+            chalk.red(
+              `Invalid --runtime '${opts.runtime}': must be 'claude' or 'codex'.`,
+            ),
+          );
+          process.exit(1);
+        }
         const agentRuntime =
           opts.runtime === "codex"
             ? "codex"
-            : opts.runtime
+            : opts.runtime === "claude"
               ? "claude"
               : undefined;
         let diskSizeGb: number | undefined;
         if (opts.disk !== undefined) {
           diskSizeGb = Number(opts.disk);
           if (!Number.isFinite(diskSizeGb) || diskSizeGb <= 0) {
-            console.error(chalk.red(`Invalid --disk '${opts.disk}': must be a positive number of GB.`));
+            console.error(
+              chalk.red(
+                `Invalid --disk '${opts.disk}': must be a positive number of GB.`,
+              ),
+            );
             process.exit(1);
           }
         }
@@ -1144,7 +1264,9 @@ export function registerOutpostsCommand(
         const refreshToken = loadCachedTokens()?.refreshToken;
         if (!refreshToken) {
           console.error(
-            chalk.red("No cached session found — run `hq login` first, then re-run."),
+            chalk.red(
+              "No cached session found — run `hq login` first, then re-run.",
+            ),
           );
           process.exit(1);
         }
@@ -1166,7 +1288,17 @@ export function registerOutpostsCommand(
             err.status === 402 &&
             err.billing
           ) {
-            await surfaceBillingRequired(token, err.billing);
+            await surfaceBillingBlocked(token, err.billing, err.message);
+            process.exit(1);
+          }
+          // Already at the per-person cap → say so and name the box they own,
+          // not a bare "Conflict".
+          if (
+            err instanceof OutpostHttpError &&
+            err.status === 409 &&
+            err.capped
+          ) {
+            surfaceOutpostCapped(err.capped);
             process.exit(1);
           }
           throw err;
@@ -1198,7 +1330,10 @@ export function registerOutpostsCommand(
           4,
           ...rows.map((r) => (r.instanceName ?? "").length),
         );
-        const regionW = Math.max(6, ...rows.map((r) => (r.region ?? "").length));
+        const regionW = Math.max(
+          6,
+          ...rows.map((r) => (r.region ?? "").length),
+        );
         const rtW = Math.max(
           7,
           ...rows.map((r) => (r.agentRuntime ?? "").length),
@@ -1295,7 +1430,9 @@ export function registerOutpostsCommand(
       try {
         const command = joinCommandParts(commandParts);
         if (!command.trim()) {
-          console.error(chalk.red("No command given. Usage: hq outposts exec -- <command>"));
+          console.error(
+            chalk.red("No command given. Usage: hq outposts exec -- <command>"),
+          );
           process.exit(1);
         }
         if (opts.async && opts.detach) {
@@ -1439,11 +1576,17 @@ export function registerOutpostsCommand(
             if (result.stderr) process.stderr.write(result.stderr);
             if (result.truncated) {
               console.error(
-                chalk.yellow("(output truncated by SSM's inline limit — redirect to a file on the box for full output)"),
+                chalk.yellow(
+                  "(output truncated by SSM's inline limit — redirect to a file on the box for full output)",
+                ),
               );
             }
             if (result.status !== "Success" && result.exitCode === null) {
-              console.error(chalk.yellow(`(command ended with SSM status: ${result.status})`));
+              console.error(
+                chalk.yellow(
+                  `(command ended with SSM status: ${result.status})`,
+                ),
+              );
             }
           }
           // Propagate the remote exit code so `hq outposts exec -- false` exits 1.
@@ -1458,7 +1601,9 @@ export function registerOutpostsCommand(
             const access = await getOutpostSshAccess(token, opts.id);
             const ssh = execViaSsh(access, remoteCommand);
             if (ssh.error) {
-              console.error(chalk.red(`Could not run the command over SSH: ${ssh.error}`));
+              console.error(
+                chalk.red(`Could not run the command over SSH: ${ssh.error}`),
+              );
               process.exit(1);
             }
             if (opts.json) {
@@ -1553,7 +1698,9 @@ export function registerOutpostsCommand(
         const command = joinCommandParts(commandParts);
         if (!command.trim()) {
           console.error(
-            chalk.red("No command given. Usage: hq outposts exec-submit -- <command>"),
+            chalk.red(
+              "No command given. Usage: hq outposts exec-submit -- <command>",
+            ),
           );
           process.exit(1);
         }
@@ -1602,7 +1749,10 @@ export function registerOutpostsCommand(
   outposts
     .command("exec-result")
     .description("Fetch the result of an asynchronous Outpost command")
-    .requiredOption("--command-id <commandId>", "Command id returned by exec-submit")
+    .requiredOption(
+      "--command-id <commandId>",
+      "Command id returned by exec-submit",
+    )
     .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
     .option("--wait", "Poll until the command reaches a terminal state")
     .option("--json", "Emit raw JSON")
@@ -1705,7 +1855,11 @@ export function registerOutpostsCommand(
       try {
         const trimmed = code.trim();
         if (!trimmed) {
-          console.error(chalk.red("Provide the sign-in code: hq outposts login-code <code>"));
+          console.error(
+            chalk.red(
+              "Provide the sign-in code: hq outposts login-code <code>",
+            ),
+          );
           process.exit(1);
         }
         const token = await ensureCognitoToken();

package/src/commands/pack-install-secret-authorization.test.ts

@@ -0,0 +1,115 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('../utils/cognito-session.js', () => ({
+  ensureCognitoToken: vi.fn(async () => 'test-token'),
+}));
+
+vi.mock('../utils/vault-api.js', () => ({
+  getCompanyUid: vi.fn(async () => 'cmp_selected'),
+  vaultApiFetchPublic: vi.fn(),
+}));
+
+vi.mock('../utils/secrets-cache.js', () => ({
+  listSecretCacheScopes: vi.fn(() => []),
+}));
+
+vi.mock('./secrets.js', () => ({
+  loadRevealedSecrets: vi.fn(),
+}));
+
+import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { getCompanyUid } from '../utils/vault-api.js';
+import { listSecretCacheScopes } from '../utils/secrets-cache.js';
+import { loadRevealedSecrets } from './secrets.js';
+import { makeInstallSecretResolver } from './pack-install.js';
+
+describe('install-time MCP secret authorization', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(ensureCognitoToken).mockResolvedValue('test-token');
+    vi.mocked(getCompanyUid).mockResolvedValue('cmp_selected');
+    vi.mocked(listSecretCacheScopes).mockReturnValue([]);
+  });
+
+  it('uses a fresh server response for one unambiguous cached scope', async () => {
+    vi.mocked(listSecretCacheScopes).mockReturnValue(['cmp_cached']);
+    vi.mocked(loadRevealedSecrets).mockResolvedValue(
+      new Map([['API_KEY', 'fresh-server-value']]),
+    );
+
+    const resolve = await makeInstallSecretResolver(['API_KEY']);
+
+    expect(loadRevealedSecrets).toHaveBeenCalledWith(
+      'test-token',
+      'cmp_cached',
+      ['API_KEY'],
+    );
+    expect(resolve('API_KEY')).toBe('fresh-server-value');
+  });
+
+  it('fails closed without reading a cached value when scopes are ambiguous', async () => {
+    vi.mocked(listSecretCacheScopes).mockReturnValue(['cmp_one', 'cmp_two']);
+
+    const resolve = await makeInstallSecretResolver(['API_KEY']);
+
+    expect(loadRevealedSecrets).not.toHaveBeenCalled();
+    expect(resolve('API_KEY')).toBeNull();
+  });
+
+  it('uses an explicit company to resolve and authorize the target scope', async () => {
+    vi.mocked(listSecretCacheScopes).mockReturnValue(['cmp_one', 'cmp_two']);
+    vi.mocked(loadRevealedSecrets).mockResolvedValue(
+      new Map([['API_KEY', 'selected-company-value']]),
+    );
+
+    const resolve = await makeInstallSecretResolver(['API_KEY'], 'indigo');
+
+    expect(getCompanyUid).toHaveBeenCalledWith('test-token', 'indigo');
+    expect(loadRevealedSecrets).toHaveBeenCalledWith(
+      'test-token',
+      'cmp_selected',
+      ['API_KEY'],
+    );
+    expect(resolve('API_KEY')).toBe('selected-company-value');
+  });
+
+  it.each([
+    ['forbidden', new Error('Forbidden')],
+    ['not found', new Error('Secret not found')],
+    ['offline', new TypeError('fetch failed: ENETUNREACH')],
+    ['timeout', new DOMException('The operation was aborted due to timeout', 'TimeoutError')],
+  ])('defers registration when online authorization is %s', async (_label, failure) => {
+    vi.mocked(listSecretCacheScopes).mockReturnValue(['cmp_cached']);
+    vi.mocked(loadRevealedSecrets).mockRejectedValue(failure);
+
+    const resolve = await makeInstallSecretResolver(['API_KEY']);
+
+    expect(resolve('API_KEY')).toBeNull();
+  });
+
+  it('does not reuse an earlier authorized value after the server revokes access', async () => {
+    vi.mocked(listSecretCacheScopes).mockReturnValue(['cmp_cached']);
+    vi.mocked(loadRevealedSecrets)
+      .mockResolvedValueOnce(new Map([['API_KEY', 'initial-authorized-value']]))
+      .mockRejectedValueOnce(new Error('No read permission'));
+
+    const initiallyAuthorized = await makeInstallSecretResolver(['API_KEY']);
+    const afterRevocation = await makeInstallSecretResolver(['API_KEY']);
+
+    expect(initiallyAuthorized('API_KEY')).toBe('initial-authorized-value');
+    expect(afterRevocation('API_KEY')).toBeNull();
+    expect(loadRevealedSecrets).toHaveBeenCalledTimes(2);
+  });
+
+  it('fails closed when no non-interactive HQ session is available', async () => {
+    vi.mocked(ensureCognitoToken).mockRejectedValue(
+      new Error('No valid HQ session'),
+    );
+    vi.mocked(listSecretCacheScopes).mockReturnValue(['cmp_cached']);
+
+    const resolve = await makeInstallSecretResolver(['API_KEY']);
+
+    expect(loadRevealedSecrets).not.toHaveBeenCalled();
+    expect(resolve('API_KEY')).toBeNull();
+  });
+});

package/src/commands/pack-install.test.ts

@@ -127,6 +127,10 @@ describe('pack-install: install path layout', () => {
   });
 
   // ---- 3. scan-packages.sh resolution -------------------------------------
+  // Spawns a real `bash` subprocess (spawnSync), which under the saturated
+  // full-suite parallel pool can take well past vitest's 5s default. The work
+  // is a trivial `touch`; the extra budget is for scheduling contention, not
+  // slow logic. Isolated, this runs in milliseconds.
   it('runScanPackages invokes core/scripts/scan-packages.sh when present', () => {
     const scriptDir = path.join(hqRoot, 'core', 'scripts');
     fs.mkdirSync(scriptDir, { recursive: true });
@@ -142,7 +146,7 @@ describe('pack-install: install path layout', () => {
     runScanPackages(hqRoot);
 
     expect(fs.existsSync(sentinel)).toBe(true);
-  });
+  }, 30_000);
 
   it('runScanPackages skips with a dim warning when core/scripts/scan-packages.sh is absent', () => {
     // No script anywhere — runScanPackages must not throw, must not invoke