@indigoai-us/hq-cli 5.77.12 → 5.77.13

package/dist/utils/vault-api.js

@@ -63,7 +63,7 @@ async function peekPlanLimitStatus(response) {
     }
 }
 export async function vaultApiFetch(opts) {
-    const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
+    const url = new URL(opts.path, opts.baseUrl ?? DEFAULT_VAULT_API_URL);
     if (opts.query) {
         for (const [k, v] of Object.entries(opts.query)) {
             url.searchParams.set(k, v);
@@ -274,10 +274,11 @@ export async function getCompanyUid(token, companySlug) {
 }
 // Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
 // createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
-export async function resolveCallerPersonUid(token) {
+export async function resolveCallerPersonUid(token, baseUrl) {
     const res = await vaultApiFetch({
         token,
         path: '/entity/by-type/person',
+        baseUrl,
     });
     if (!res.ok) {
         throw new Error("Failed to fetch person entity — run `hq login` and try again");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.77.12",
+  "version": "5.77.13",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -21,6 +21,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
+    "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
     "@indigoai-us/hq-cloud": "^6.14.27",
     "@indigoai-us/hq-onboarding": "^0.1.0",
@@ -42,6 +43,7 @@
     "@types/node": "^22.0.0",
     "@types/semver": "^7.5.8",
     "@vitest/coverage-v8": "4.1.6",
+    "aws-sdk-client-mock": "^4.1.0",
     "eslint": "^10.5.0",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.61.1",

package/src/commands/outposts-heartbeat.test.ts

@@ -0,0 +1,299 @@
+/**
+ * Unit tests for `hq outposts heartbeat` (outposts-heartbeat.ts).
+ *
+ * The loop runs ON the box under systemd, so the properties that matter are
+ * operational, not cosmetic:
+ *   - it ticks on a cadence and NEVER dies on a transient failure;
+ *   - it resolves identity ONCE per process, not once per tick (the whole point
+ *     of moving the cadence in-process — the old bash loop re-authenticated and
+ *     re-resolved a package every 5s);
+ *   - nothing leaves the box that fails the no-secrets contract.
+ *
+ * Everything the loop touches (clock, sleep, publish, identity, fs) is injected
+ * so these run without a network, a real box, or real time.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import {
+  resolveIntervalSeconds,
+  runHeartbeatLoop,
+  type HeartbeatLoopDeps,
+} from "./outposts-heartbeat.js";
+import type {
+  FileSystemPort,
+  SessionsHeartbeatPayload,
+} from "../outpost/session-heartbeat.js";
+
+const PERSON_UID = "prs_01TESTPERSON";
+
+/** An fs port with no sessions on disk — enumeration yields an empty payload. */
+const emptyFs: FileSystemPort = {
+  readDir: async () => [],
+  stat: async () => ({ mtimeMs: 0, birthtimeMs: 0, size: 0 }),
+  readTextFile: async () => "",
+  readBounded: async () => "",
+};
+
+function makeDeps(over: Partial<HeartbeatLoopDeps> = {}): {
+  deps: HeartbeatLoopDeps;
+  published: { topic: string; payload: SessionsHeartbeatPayload }[];
+  sleeps: number[];
+  logs: string[];
+  personUidCalls: () => number;
+} {
+  const published: { topic: string; payload: SessionsHeartbeatPayload }[] = [];
+  const sleeps: number[] = [];
+  const logs: string[] = [];
+  const getPersonUid = vi.fn(async () => PERSON_UID);
+
+  const deps: HeartbeatLoopDeps = {
+    fs: emptyFs,
+    publish: async (topic, payload) => {
+      published.push({ topic, payload });
+    },
+    getPersonUid,
+    sleep: async (ms: number) => {
+      sleeps.push(ms);
+    },
+    now: () => new Date("2026-07-29T00:00:00.000Z"),
+    log: (line: string) => logs.push(line),
+    ...over,
+  };
+
+  return {
+    deps,
+    published,
+    sleeps,
+    logs,
+    personUidCalls: () => getPersonUid.mock.calls.length,
+  };
+}
+
+describe("resolveIntervalSeconds", () => {
+  it("prefers the explicit flag over the environment", () => {
+    expect(
+      resolveIntervalSeconds("30", {
+        OUTPOST_SESSIONS_HEARTBEAT_INTERVAL_SECONDS: "9",
+      }),
+    ).toBe(30);
+  });
+
+  it("falls back to the environment when no flag is given", () => {
+    expect(
+      resolveIntervalSeconds(undefined, {
+        OUTPOST_SESSIONS_HEARTBEAT_INTERVAL_SECONDS: "9",
+      }),
+    ).toBe(9);
+  });
+
+  it("defaults to 5s when neither is set", () => {
+    expect(resolveIntervalSeconds(undefined, {})).toBe(5);
+  });
+
+  it("floors at 1s so a bad value cannot hammer the fabric", () => {
+    expect(resolveIntervalSeconds("0", {})).toBe(1);
+    expect(resolveIntervalSeconds("-4", {})).toBe(1);
+    expect(resolveIntervalSeconds("not-a-number", {})).toBe(5);
+  });
+});
+
+describe("runHeartbeatLoop", () => {
+  it("--once emits exactly one heartbeat and returns", async () => {
+    const { deps, published, sleeps } = makeDeps();
+
+    const ticks = await runHeartbeatLoop({ once: true }, deps);
+
+    expect(ticks).toBe(1);
+    expect(published).toHaveLength(1);
+    expect(published[0].topic).toBe(`hq/${PERSON_UID}/sessions`);
+    expect(published[0].payload.type).toBe("sessions");
+    expect(published[0].payload.origin).toBe("outpost");
+    // One-shot must not sleep — systemd/an operator owns the cadence there.
+    expect(sleeps).toEqual([]);
+  });
+
+  it("ticks repeatedly on the configured cadence, sleeping between ticks", async () => {
+    const { deps, published, sleeps } = makeDeps();
+
+    const ticks = await runHeartbeatLoop(
+      { intervalSeconds: 5, maxTicks: 3 },
+      deps,
+    );
+
+    expect(ticks).toBe(3);
+    expect(published).toHaveLength(3);
+    // N ticks ⇒ N-1 gaps. The loop must not sleep before exiting.
+    expect(sleeps).toEqual([5000, 5000]);
+  });
+
+  it("resolves identity ONCE per process, not once per tick", async () => {
+    // Regression guard for the original design: the bash loop re-ran
+    // `hq auth refresh` AND re-resolved an npm package on every single tick.
+    const { deps, personUidCalls } = makeDeps();
+
+    await runHeartbeatLoop({ intervalSeconds: 1, maxTicks: 10 }, deps);
+
+    expect(personUidCalls()).toBe(1);
+  });
+
+  it("survives a publish failure and keeps beating", async () => {
+    let attempt = 0;
+    const { deps, published, logs } = makeDeps({
+      publish: async (topic, payload) => {
+        attempt += 1;
+        if (attempt === 2) throw new Error("iot unavailable");
+        published.push({ topic, payload });
+      },
+    });
+
+    const ticks = await runHeartbeatLoop({ maxTicks: 3 }, deps);
+
+    expect(ticks).toBe(3);
+    // Ticks 1 and 3 landed; tick 2 failed without killing the loop.
+    expect(published).toHaveLength(2);
+    expect(logs.join("\n")).toContain("iot unavailable");
+  });
+
+  it("survives a collection failure and keeps beating", async () => {
+    let calls = 0;
+    const { deps, published, logs } = makeDeps({
+      fs: {
+        ...emptyFs,
+        readDir: async () => {
+          calls += 1;
+          if (calls === 1) throw new Error("EIO: disk unhappy");
+          return [];
+        },
+      },
+    });
+
+    const ticks = await runHeartbeatLoop({ maxTicks: 2 }, deps);
+
+    expect(ticks).toBe(2);
+    expect(published).toHaveLength(1);
+    expect(logs.join("\n")).toContain("disk unhappy");
+  });
+
+  it("keeps beating when identity cannot be resolved yet", async () => {
+    // A box that boots before its session is warm must retry, not exit — a
+    // crash here is what systemd Restart= masks into a silent flap.
+    let calls = 0;
+    const { deps, published } = makeDeps({
+      getPersonUid: async () => {
+        calls += 1;
+        if (calls === 1) throw new Error("no cached HQ session");
+        return PERSON_UID;
+      },
+    });
+
+    const ticks = await runHeartbeatLoop({ maxTicks: 2 }, deps);
+
+    expect(ticks).toBe(2);
+    expect(published).toHaveLength(1);
+  });
+
+  it("never publishes a payload that fails the no-secrets guard", async () => {
+    const { deps, published, logs } = makeDeps({
+      fs: {
+        ...emptyFs,
+        readDir: async (path: string) => {
+          // Only the Claude tree has anything in it; Codex enumeration must
+          // come back empty so the leak under test is unambiguously the
+          // sniffed Claude `model` field.
+          if (path.endsWith("/.claude/projects")) {
+            return [{ name: "-home-ec2-user-hq", isDirectory: true, isFile: false }];
+          }
+          if (path.endsWith("/.claude/projects/-home-ec2-user-hq")) {
+            return [
+              {
+                name: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee.jsonl",
+                isDirectory: false,
+                isFile: true,
+              },
+            ];
+          }
+          return [];
+        },
+        stat: async () => ({
+          mtimeMs: Date.parse("2026-07-29T00:00:00.000Z"),
+          birthtimeMs: Date.parse("2026-07-29T00:00:00.000Z"),
+          size: 128,
+        }),
+        // An adversarial transcript that tries to smuggle a key out via the
+        // sniffed model field.
+        readBounded: async () =>
+          JSON.stringify({ model: "sk-ant-api03-LEAKED-KEY-VALUE" }),
+      },
+    });
+
+    const ticks = await runHeartbeatLoop({ once: true }, deps);
+
+    expect(ticks).toBe(1);
+    expect(published).toEqual([]);
+    expect(logs.join("\n").toLowerCase()).toContain("refusing to publish");
+  });
+
+  it("records a liveness marker after a successful publish", async () => {
+    // The marker is what the box audit reads. Without it the audit can only see
+    // "systemd says active", which is exactly the signal that stayed green for
+    // nine days while every tick failed.
+    const marks: number[] = [];
+    const { deps } = makeDeps({
+      onPublished: async () => {
+        marks.push(1);
+      },
+    });
+
+    await runHeartbeatLoop({ maxTicks: 3 }, deps);
+
+    expect(marks).toHaveLength(3);
+  });
+
+  it("does NOT record a liveness marker when the publish failed", async () => {
+    // A marker written regardless of outcome would recreate the original bug in
+    // a new place: a freshness check that is always fresh.
+    const marks: number[] = [];
+    const { deps } = makeDeps({
+      publish: async () => {
+        throw new Error("iot unavailable");
+      },
+      onPublished: async () => {
+        marks.push(1);
+      },
+    });
+
+    await runHeartbeatLoop({ maxTicks: 3 }, deps);
+
+    expect(marks).toEqual([]);
+  });
+
+  it("keeps beating when the liveness marker cannot be written", async () => {
+    const { deps, published } = makeDeps({
+      onPublished: async () => {
+        throw new Error("EACCES: read-only filesystem");
+      },
+    });
+
+    const ticks = await runHeartbeatLoop({ maxTicks: 2 }, deps);
+
+    expect(ticks).toBe(2);
+    expect(published).toHaveLength(2);
+  });
+
+  it("stops promptly when aborted", async () => {
+    const controller = new AbortController();
+    const { deps, published } = makeDeps({
+      sleep: async () => {
+        controller.abort();
+      },
+    });
+
+    const ticks = await runHeartbeatLoop(
+      { intervalSeconds: 5, signal: controller.signal },
+      deps,
+    );
+
+    expect(ticks).toBe(1);
+    expect(published).toHaveLength(1);
+  });
+});

package/src/commands/outposts-heartbeat.ts

@@ -0,0 +1,310 @@
+/**
+ * `hq outposts heartbeat` — publish this box's agent-session summary to the
+ * realtime fabric.
+ *
+ * Runs ON an Outpost, under systemd. It enumerates the box's local Claude Code
+ * and Codex sessions with cheap scandir + stat + bounded reads, projects them
+ * down to the compact secret-free `AgentSession[]` payload, and publishes to
+ * `hq/{personUid}/sessions` so Mission Control can see what the box is doing.
+ *
+ * ## Why the cadence lives in here
+ *
+ * The original box-side design was a bash `while` loop that, every 5 seconds,
+ * ran `hq auth refresh` and then `npx -y --package=@indigoai-us/hq-cloud@latest
+ * outpost-session-heartbeat-runner`. That is ~35k process launches a day, and
+ * every `npx` re-resolves the package and re-reads it off disk — on a t3 box
+ * whose EBS budget is the scarce resource, that is a meaningful, permanent tax
+ * for a job that should be nearly free.
+ *
+ * So the loop lives in-process instead:
+ *   - identity is resolved ONCE per process, not once per tick;
+ *   - the Cognito session refreshes itself on demand (`ensureCognitoToken`
+ *     returns the cached token until it is close to expiry), so there is no
+ *     separate per-tick `hq auth refresh`;
+ *   - the IoT client is cached across ticks by the publisher and only rebuilt
+ *     when its credentials near expiry.
+ *
+ * The loop is deliberately unkillable-by-transients: a failed publish, a failed
+ * enumeration, or a not-yet-warm session are all logged and retried on the next
+ * tick. Nothing here should ever take the service down, because a service that
+ * exits looks identical to a service that is quietly failing.
+ */
+
+import type { Command } from "commander";
+import { mkdir, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { DEFAULT_VAULT_API_URL } from "../utils/cognito-session.js";
+import { resolveCallerPersonUid } from "../utils/vault-api.js";
+import {
+  DEFAULT_HEARTBEAT_INTERVAL_SECONDS,
+  collectSessions,
+  nodeFileSystem,
+  sessionsTopicForPerson,
+  type FileSystemPort,
+  type PublishPort,
+  type SessionsHeartbeatPayload,
+} from "../outpost/session-heartbeat.js";
+import {
+  createIotPublishPort,
+  defaultRealtimeCredentialsFetcher,
+} from "../outpost/session-heartbeat-publisher.js";
+
+/** Everything the loop touches, injected so it is testable without a box. */
+export interface HeartbeatLoopDeps {
+  fs: FileSystemPort;
+  publish: PublishPort;
+  /** Resolve the caller's canonical `prs_*` id. Called once per process. */
+  getPersonUid: () => Promise<string>;
+  /**
+   * Wait between ticks. MUST return early when `signal` aborts — otherwise a
+   * SIGTERM arriving mid-sleep is not noticed until the full interval elapses,
+   * and systemd force-kills the process instead of it stopping cooperatively.
+   */
+  sleep: (ms: number, signal?: AbortSignal) => Promise<void>;
+  now: () => Date;
+  log: (line: string) => void;
+  /**
+   * Record that a heartbeat actually LANDED. Called only after a successful
+   * publish — never on failure, or the freshness signal it feeds would always
+   * read fresh and be worth nothing.
+   */
+  onPublished?: (payload: SessionsHeartbeatPayload) => Promise<void>;
+}
+
+export interface HeartbeatLoopOptions {
+  /** Emit a single heartbeat and return. */
+  once?: boolean;
+  /** Cadence between ticks. Defaults to {@link DEFAULT_HEARTBEAT_INTERVAL_SECONDS}. */
+  intervalSeconds?: number;
+  /** Home directory to scan (defaults to the process HOME). */
+  home?: string;
+  /** Print each published payload as JSON. */
+  json?: boolean;
+  /** Stop the loop cooperatively. */
+  signal?: AbortSignal;
+  /** Bound the loop — used by tests; production runs until aborted. */
+  maxTicks?: number;
+}
+
+/**
+ * Resolve the cadence from the flag, then the environment, then the default.
+ * Floored at 1s: a sub-second cadence hammers the fabric for no benefit, and a
+ * zero/negative value would spin the loop hot.
+ */
+export function resolveIntervalSeconds(
+  flag: string | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+): number {
+  for (const raw of [flag, env.OUTPOST_SESSIONS_HEARTBEAT_INTERVAL_SECONDS]) {
+    if (raw === undefined || raw === null || raw === "") continue;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed)) return DEFAULT_HEARTBEAT_INTERVAL_SECONDS;
+    return Math.max(1, parsed);
+  }
+  return DEFAULT_HEARTBEAT_INTERVAL_SECONDS;
+}
+
+/**
+ * Where the box records its last LANDED heartbeat. The post-provision audit
+ * reads this file's freshness, because "systemd says the unit is active" is not
+ * evidence that anything was published — that gap is what let a heartbeat fail
+ * every five seconds for nine days while every dashboard stayed green.
+ *
+ * Lives under the service user's home so the unit (User=ec2-user) can write it
+ * without extra tmpfiles.d wiring; the SSM collector reads it as root.
+ */
+export const DEFAULT_HEARTBEAT_STATE_FILE = join(
+  homedir(),
+  ".hq",
+  "outpost-session-heartbeat.json",
+);
+
+/** Persist the liveness marker the box audit reads. */
+export async function writeHeartbeatState(
+  path: string,
+  payload: SessionsHeartbeatPayload,
+): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(
+    path,
+    `${JSON.stringify({
+      lastPublishAt: payload.emittedAt,
+      sessions: payload.sessions.length,
+    })}\n`,
+    "utf8",
+  );
+}
+
+/** Structured one-line log — journald gets JSON, not prose. */
+function logLine(
+  step: string,
+  outcome: "ok" | "error",
+  extra: Record<string, unknown>,
+  now: () => Date,
+): string {
+  return JSON.stringify({
+    service: "outpost-session-heartbeat",
+    step,
+    outcome,
+    ...extra,
+    timestamp: now().toISOString(),
+  });
+}
+
+/**
+ * Run the heartbeat loop. Returns the number of ticks performed.
+ *
+ * A "tick" is one attempt, whether or not it published — the count is the
+ * loop's liveness, not its success rate.
+ */
+export async function runHeartbeatLoop(
+  options: HeartbeatLoopOptions,
+  deps: HeartbeatLoopDeps,
+): Promise<number> {
+  const intervalMs =
+    (options.intervalSeconds ?? DEFAULT_HEARTBEAT_INTERVAL_SECONDS) * 1000;
+  const maxTicks = options.once ? 1 : options.maxTicks;
+
+  // Resolved once and reused. Re-resolving per tick was the original sin.
+  let personUid: string | null = null;
+  let ticks = 0;
+
+  for (;;) {
+    ticks += 1;
+
+    try {
+      if (!personUid) personUid = await deps.getPersonUid();
+      const payload = await collectSessions(
+        { personUid, home: options.home, now: deps.now },
+        { fs: deps.fs },
+      );
+      const topic = sessionsTopicForPerson(personUid);
+      await deps.publish(topic, payload);
+      // Ordering matters: the marker is written only once the publish has
+      // resolved, so a stale marker means "nothing landed", not "nothing ran".
+      await deps.onPublished?.(payload);
+      if (options.json) deps.log(JSON.stringify(payload));
+      deps.log(
+        logLine(
+          "publish",
+          "ok",
+          { topic, sessions: payload.sessions.length },
+          deps.now,
+        ),
+      );
+    } catch (err) {
+      // Every failure mode lands here on purpose: a transient must never take
+      // the service down, because systemd restarting a hot-failing loop looks
+      // exactly like a healthy one.
+      deps.log(
+        logLine(
+          "tick",
+          "error",
+          { message: err instanceof Error ? err.message : String(err) },
+          deps.now,
+        ),
+      );
+    }
+
+    if (options.once) break;
+    if (maxTicks !== undefined && ticks >= maxTicks) break;
+    if (options.signal?.aborted) break;
+
+    await deps.sleep(intervalMs, options.signal);
+    if (options.signal?.aborted) break;
+  }
+
+  return ticks;
+}
+
+/** Wire the production dependencies and register the subcommand. */
+export function registerHeartbeatCommand(outposts: Command): void {
+  outposts
+    .command("heartbeat", { hidden: true })
+    .description(
+      "Publish this box's agent-session summary to the realtime fabric (runs on the Outpost, under systemd)",
+    )
+    .option("--once", "Emit a single heartbeat and exit")
+    .option(
+      "--interval <seconds>",
+      "Cadence in seconds (default 5; env OUTPOST_SESSIONS_HEARTBEAT_INTERVAL_SECONDS)",
+    )
+    .option("--home <path>", "Home directory to scan for sessions")
+    .option("--api-base-url <url>", "HQ API base URL")
+    .option(
+      "--state-file <path>",
+      `Liveness marker read by the box audit (default ${DEFAULT_HEARTBEAT_STATE_FILE})`,
+    )
+    .option("--json", "Print each published payload as JSON")
+    .action(
+      async (opts: {
+        once?: boolean;
+        interval?: string;
+        home?: string;
+        apiBaseUrl?: string;
+        stateFile?: string;
+        json?: boolean;
+      }) => {
+        const apiBaseUrl =
+          opts.apiBaseUrl ??
+          process.env.HQAPI_BASE_URL ??
+          DEFAULT_VAULT_API_URL;
+
+        const getJwt = () => ensureCognitoToken({ interactive: false });
+
+        const deps: HeartbeatLoopDeps = {
+          fs: nodeFileSystem,
+          publish: createIotPublishPort({
+            fetchCredentials: defaultRealtimeCredentialsFetcher({
+              apiBaseUrl,
+              getJwt,
+            }),
+          }),
+          // Same base as the credentials fetch. Resolving identity against the
+          // default plane while vending credentials from another sends a
+          // deployment-specific token to the wrong control plane, which is
+          // rejected — and the loop then retries forever without publishing.
+          getPersonUid: async () =>
+            resolveCallerPersonUid(await getJwt(), apiBaseUrl),
+          sleep: (ms, signal) =>
+            new Promise((resolve) => {
+              if (signal?.aborted) return resolve();
+              const t = setTimeout(done, ms);
+              function done() {
+                clearTimeout(t);
+                signal?.removeEventListener("abort", done);
+                resolve();
+              }
+              signal?.addEventListener("abort", done, { once: true });
+            }),
+          now: () => new Date(),
+          log: (line) => console.error(line),
+          onPublished: (payload) =>
+            writeHeartbeatState(
+              opts.stateFile ?? DEFAULT_HEARTBEAT_STATE_FILE,
+              payload,
+            ),
+        };
+
+        // systemd sends SIGTERM on stop/restart — finish the in-flight tick,
+        // then exit cleanly rather than being killed mid-publish.
+        const controller = new AbortController();
+        const stop = () => controller.abort();
+        process.once("SIGTERM", stop);
+        process.once("SIGINT", stop);
+
+        await runHeartbeatLoop(
+          {
+            once: opts.once,
+            intervalSeconds: resolveIntervalSeconds(opts.interval),
+            home: opts.home,
+            json: opts.json,
+            signal: controller.signal,
+          },
+          deps,
+        );
+      },
+    );
+}

package/src/commands/outposts.ts

@@ -33,6 +33,7 @@ import * as yaml from "js-yaml";
 import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
+import { registerHeartbeatCommand } from "./outposts-heartbeat.js";
 import {
   OUTPOST_PRICE_CENTS,
   confirmChargeOrExit,
@@ -1160,6 +1161,9 @@ export function registerOutpostsCommand(
     .command("outposts")
     .description("Manage your personal HQ Outposts (EC2 boxes)");
 
+  // On-box session heartbeat (systemd). Hidden — operators never run it.
+  registerHeartbeatCommand(outposts);
+
   outposts
     .command("self-deploy", { hidden: true })
     .description("Configure this EC2 host as a locally self-hosted HQ outpost")