@indigoai-us/hq-cli 5.77.12 → 5.77.13

package/src/packaging.test.ts

@@ -61,4 +61,49 @@ describe("packaging: runtime dependencies", () => {
     expect(pkg.dependencies).toHaveProperty("@aws-sdk/client-s3");
     expect(pkg.devDependencies).not.toHaveProperty("@aws-sdk/client-s3");
   });
+
+  it("ships the IoT data-plane client imported by the session heartbeat", () => {
+    expect(pkg.dependencies).toHaveProperty("@aws-sdk/client-iot-data-plane");
+    expect(pkg.devDependencies).not.toHaveProperty(
+      "@aws-sdk/client-iot-data-plane",
+    );
+  });
+});
+
+/**
+ * Regression pin for the 2026-07 dead-heartbeat incident.
+ *
+ * The Outpost's systemd unit invoked `outpost-session-heartbeat-runner`, a
+ * command that was never written. The provisioning test asserted only that the
+ * generated user-data CONTAINED that string, so it passed for the entire life
+ * of the bug while the box logged "command not found" every five seconds and
+ * the box audit reported the service healthy.
+ *
+ * The lesson: asserting that a command NAME appears somewhere proves nothing.
+ * Assert the command RESOLVES. If `hq outposts heartbeat` is ever renamed,
+ * un-registered, or dropped from the build, this fails here — before a box is
+ * provisioned against it.
+ */
+describe("packaging: on-box commands the Outpost user-data invokes", () => {
+  it("registers `hq outposts heartbeat`", async () => {
+    const { Command } = await import("commander");
+    const { registerOutpostsCommand } = await import("./commands/outposts.js");
+
+    const program = new Command();
+    registerOutpostsCommand(program);
+
+    const outposts = program.commands.find((c) => c.name() === "outposts");
+    expect(outposts, "`hq outposts` must be registered").toBeDefined();
+
+    const heartbeat = outposts?.commands.find((c) => c.name() === "heartbeat");
+    expect(heartbeat, "`hq outposts heartbeat` must be registered").toBeDefined();
+
+    // The flags the systemd unit passes must all exist, or the unit dies on an
+    // "unknown option" at boot — a failure mode indistinguishable from the one
+    // this test exists to prevent.
+    const flags = (heartbeat?.options ?? []).map((o) => o.long);
+    expect(flags).toEqual(
+      expect.arrayContaining(["--once", "--interval", "--home", "--api-base-url"]),
+    );
+  });
 });

package/src/utils/vault-api.ts

@@ -5,6 +5,13 @@ import { CompanySelectionError } from './company-selection-error.js';
 import { recordPlanLimitStatus } from '../lib/plan-limit-nag.js';
 
 export interface VaultApiOptions {
+  /**
+   * Control-plane origin. Defaults to DEFAULT_VAULT_API_URL. Set it when a
+   * caller has been pointed at another deployment, so identity and every
+   * other call resolve against the SAME plane — a token minted for one and
+   * sent to another is simply rejected, which reads as an auth failure.
+   */
+  baseUrl?: string;
   token: string;
   path: string;
   method?: string;
@@ -72,7 +79,7 @@ async function peekPlanLimitStatus(response: Response): Promise<Response> {
 }
 
 export async function vaultApiFetch(opts: VaultApiOptions): Promise<Response> {
-  const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
+  const url = new URL(opts.path, opts.baseUrl ?? DEFAULT_VAULT_API_URL);
   if (opts.query) {
     for (const [k, v] of Object.entries(opts.query)) {
       url.searchParams.set(k, v);
@@ -335,10 +342,14 @@ interface PersonEntity {
 
 // Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
 // createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
-export async function resolveCallerPersonUid(token: string): Promise<string> {
+export async function resolveCallerPersonUid(
+  token: string,
+  baseUrl?: string,
+): Promise<string> {
   const res = await vaultApiFetch({
     token,
     path: '/entity/by-type/person',
+    baseUrl,
   });
   if (!res.ok) {
     throw new Error("Failed to fetch person entity — run `hq login` and try again");