@indigoai-us/hq-cli 5.77.14 → 5.79.0

package/src/packaging.test.ts

@@ -1,109 +0,0 @@
-/**
- * Packaging guard: every declared `bin` must ship EXECUTABLE.
- *
- * Regression pin for the "outpost is not CLI-ready" class of failure: `tsc`
- * emits dist bins as 0644, and a root global install on a fresh outpost has
- * been observed to leave the linked target non-executable, so `/usr/bin/hq`
- * dies with "Permission denied" and the box never becomes usable. The build
- * runs `scripts/chmod-bins.mjs` to 0755 the bins; this test locks that wiring
- * in and, when a build has already produced `dist/`, asserts the bits directly.
- */
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
-
-const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const pkg = JSON.parse(
-  readFileSync(resolve(repoRoot, "package.json"), "utf8"),
-) as {
-  bin?: Record<string, string> | string;
-  dependencies?: Record<string, string>;
-  devDependencies?: Record<string, string>;
-  scripts?: Record<string, string>;
-};
-
-const binMap =
-  typeof pkg.bin === "string" ? { hq: pkg.bin } : (pkg.bin ?? {});
-
-describe("packaging: bin executable bit", () => {
-  it("wires the chmod-bins step into build and prepublishOnly", () => {
-    expect(pkg.scripts?.build ?? "").toContain("chmod-bins");
-    // prepublishOnly must rebuild so a publish always re-chmods, regardless of
-    // the publisher's local dist state.
-    expect(pkg.scripts?.prepublishOnly ?? "").toContain("build");
-  });
-
-  it("declares at least one bin, all pointing at built .js files", () => {
-    const entries = Object.entries(binMap);
-    expect(entries.length).toBeGreaterThan(0);
-    for (const [, relPath] of entries) {
-      expect(relPath.endsWith(".js")).toBe(true);
-    }
-  });
-
-  it("ships every bin executable once dist is built", () => {
-    for (const [name, relPath] of Object.entries(binMap)) {
-      const target = resolve(repoRoot, relPath);
-      // Pre-build (e.g. a bare `vitest` before `tsc`) → nothing to assert yet.
-      if (!existsSync(target)) continue;
-      const mode = statSync(target).mode;
-      // Owner-executable bit is the one that matters for `npm` bin linking.
-      expect(mode & 0o100, `${name} (${relPath}) must be executable`).toBe(
-        0o100,
-      );
-    }
-  });
-});
-
-describe("packaging: runtime dependencies", () => {
-  it("ships the S3 client imported by files-browse", () => {
-    expect(pkg.dependencies).toHaveProperty("@aws-sdk/client-s3");
-    expect(pkg.devDependencies).not.toHaveProperty("@aws-sdk/client-s3");
-  });
-
-  it("ships the IoT data-plane client imported by the session heartbeat", () => {
-    expect(pkg.dependencies).toHaveProperty("@aws-sdk/client-iot-data-plane");
-    expect(pkg.devDependencies).not.toHaveProperty(
-      "@aws-sdk/client-iot-data-plane",
-    );
-  });
-});
-
-/**
- * Regression pin for the 2026-07 dead-heartbeat incident.
- *
- * The Outpost's systemd unit invoked `outpost-session-heartbeat-runner`, a
- * command that was never written. The provisioning test asserted only that the
- * generated user-data CONTAINED that string, so it passed for the entire life
- * of the bug while the box logged "command not found" every five seconds and
- * the box audit reported the service healthy.
- *
- * The lesson: asserting that a command NAME appears somewhere proves nothing.
- * Assert the command RESOLVES. If `hq outposts heartbeat` is ever renamed,
- * un-registered, or dropped from the build, this fails here — before a box is
- * provisioned against it.
- */
-describe("packaging: on-box commands the Outpost user-data invokes", () => {
-  it("registers `hq outposts heartbeat`", async () => {
-    const { Command } = await import("commander");
-    const { registerOutpostsCommand } = await import("./commands/outposts.js");
-
-    const program = new Command();
-    registerOutpostsCommand(program);
-
-    const outposts = program.commands.find((c) => c.name() === "outposts");
-    expect(outposts, "`hq outposts` must be registered").toBeDefined();
-
-    const heartbeat = outposts?.commands.find((c) => c.name() === "heartbeat");
-    expect(heartbeat, "`hq outposts heartbeat` must be registered").toBeDefined();
-
-    // The flags the systemd unit passes must all exist, or the unit dies on an
-    // "unknown option" at boot — a failure mode indistinguishable from the one
-    // this test exists to prevent.
-    const flags = (heartbeat?.options ?? []).map((o) => o.long);
-    expect(flags).toEqual(
-      expect.arrayContaining(["--once", "--interval", "--home", "--api-base-url"]),
-    );
-  });
-});

package/src/run/__fixtures__/discover-schemas/example.env.schema

@@ -1,4 +0,0 @@
-# @hqCompany("example-co")
-
-DATABASE_URL=hq()
-API_KEY=hq()

package/src/run/discover-schemas.test.ts

@@ -1,153 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { discoverSchemas } from './discover-schemas.js';
-
-let tmpDir: string;
-
-// Helper: create directory + optional files inside it.
-function mkDir(...segments: string[]): string {
-  const dir = path.join(tmpDir, ...segments);
-  fs.mkdirSync(dir, { recursive: true });
-  return dir;
-}
-
-function writeFile(dir: string, name: string, content: string): string {
-  const p = path.join(dir, name);
-  fs.writeFileSync(p, content);
-  return p;
-}
-
-// Every temp tree gets a .git/ at the root so the walk-up never escapes tmpDir.
-function makeRoot(): string {
-  const root = mkDir('root');
-  fs.mkdirSync(path.join(root, '.git'), { recursive: true });
-  return root;
-}
-
-const SCHEMA_CO_A = '# @hqCompany("co-a")\n\nFOO=hq()\n';
-const SCHEMA_CO_B = '# @hqCompany("co-b")\n\nBAR=hq()\n';
-const SCHEMA_CO_E = '# @hqCompany("co-e")\n\nFOO=hq()\n';
-const SCHEMA_CO_F = '# @hqCompany("co-f")\n\nFOO=hq()\n';
-const SCHEMA_CO_G = '# @hqCompany("co-g")\n\nFOO=hq()\n';
-
-beforeEach(() => {
-  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'discover-schemas-test-'));
-});
-
-afterEach(() => {
-  fs.rmSync(tmpDir, { recursive: true, force: true });
-});
-
-describe('discoverSchemas', () => {
-  // (a) Single schema in cwd — schemaPaths length 1, envLocalPaths length 0, slug matches.
-  it('(a) single schema in cwd', () => {
-    const root = makeRoot();
-    const cwd = mkDir('root', 'cwd');
-    writeFile(cwd, '.env.schema', SCHEMA_CO_A);
-
-    const result = discoverSchemas(cwd);
-
-    expect(result.schemaPaths).toHaveLength(1);
-    expect(result.schemaPaths[0]).toBe(path.join(cwd, '.env.schema'));
-    expect(result.envLocalPaths).toHaveLength(0);
-    expect(result.companySlug).toBe('co-a');
-    expect(result.conflict).toBeNull();
-  });
-
-  // (b) Parent + child both have schemas with same slug — schemaPaths length 2 (parent first, child last).
-  it('(b) parent and child schemas with same slug', () => {
-    const root = makeRoot();
-    const parent = mkDir('root', 'parent');
-    const child = mkDir('root', 'parent', 'child');
-    writeFile(parent, '.env.schema', SCHEMA_CO_A);
-    writeFile(child, '.env.schema', SCHEMA_CO_A);
-
-    const result = discoverSchemas(child);
-
-    expect(result.schemaPaths).toHaveLength(2);
-    expect(result.schemaPaths[0]).toBe(path.join(parent, '.env.schema')); // parent first
-    expect(result.schemaPaths[1]).toBe(path.join(child, '.env.schema'));  // child last (cwd-closest)
-    expect(result.companySlug).toBe('co-a');
-    expect(result.conflict).toBeNull();
-  });
-
-  // (c) Parent has slug A, child has slug B — conflict reported with both paths and both slugs.
-  it('(c) conflicting slugs', () => {
-    const root = makeRoot();
-    const parent = mkDir('root', 'parent');
-    const child = mkDir('root', 'parent', 'child');
-    writeFile(parent, '.env.schema', SCHEMA_CO_A);
-    writeFile(child, '.env.schema', SCHEMA_CO_B);
-
-    const result = discoverSchemas(child);
-
-    expect(result.schemaPaths).toHaveLength(2);
-    expect(result.companySlug).toBeNull();
-    expect(result.conflict).not.toBeNull();
-    expect(result.conflict!.paths).toContain(path.join(parent, '.env.schema'));
-    expect(result.conflict!.paths).toContain(path.join(child, '.env.schema'));
-    expect(result.conflict!.slugs).toContain('co-a');
-    expect(result.conflict!.slugs).toContain('co-b');
-  });
-
-  // (d) No schema found from cwd up — empty result.
-  it('(d) no schema found', () => {
-    const root = makeRoot();
-    const cwd = mkDir('root', 'cwd');
-
-    const result = discoverSchemas(cwd);
-
-    expect(result.schemaPaths).toHaveLength(0);
-    expect(result.envLocalPaths).toHaveLength(0);
-    expect(result.companySlug).toBeNull();
-    expect(result.conflict).toBeNull();
-  });
-
-  // (e) Schema at cwd PLUS sibling .env.local — schemaPaths length 1, envLocalPaths length 1.
-  it('(e) schema with sibling .env.local', () => {
-    const root = makeRoot();
-    const cwd = mkDir('root', 'cwd');
-    writeFile(cwd, '.env.schema', SCHEMA_CO_E);
-    writeFile(cwd, '.env.local', 'FOO=local-override\n');
-
-    const result = discoverSchemas(cwd);
-
-    expect(result.schemaPaths).toHaveLength(1);
-    expect(result.envLocalPaths).toHaveLength(1);
-    expect(result.envLocalPaths[0]).toBe(path.join(cwd, '.env.local'));
-    expect(result.companySlug).toBe('co-e');
-  });
-
-  // (f) Repo-root has .env.schema next to .git/, cwd is grandchild — schemaPaths length 1
-  //     pointing at repo-root (.git/-containing dir IS included).
-  it('(f) schema at .git root, cwd is grandchild', () => {
-    const root = makeRoot(); // root has .git/ already
-    writeFile(root, '.env.schema', SCHEMA_CO_F);
-    const child = mkDir('root', 'child');
-    const grandchild = mkDir('root', 'child', 'grandchild');
-
-    const result = discoverSchemas(grandchild);
-
-    expect(result.schemaPaths).toHaveLength(1);
-    expect(result.schemaPaths[0]).toBe(path.join(root, '.env.schema'));
-    expect(result.companySlug).toBe('co-f');
-  });
-
-  // (g) Parent has .env.local but no schema, child has schema — envLocalPaths length 0
-  //     (.env.local collected ONLY when next to a .env.schema).
-  it('(g) .env.local without schema in parent is ignored', () => {
-    const root = makeRoot();
-    const parent = mkDir('root', 'parent');
-    const child = mkDir('root', 'parent', 'child');
-    writeFile(parent, '.env.local', 'PARENT_ONLY=1\n');
-    writeFile(child, '.env.schema', SCHEMA_CO_G);
-
-    const result = discoverSchemas(child);
-
-    expect(result.schemaPaths).toHaveLength(1);
-    expect(result.envLocalPaths).toHaveLength(0);
-    expect(result.companySlug).toBe('co-g');
-  });
-});

package/src/run/discover-schemas.ts

@@ -1,79 +0,0 @@
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-
-export interface SchemaConflict {
-  paths: [string, string];
-  slugs: [string, string];
-}
-
-export interface DiscoverSchemasResult {
-  schemaPaths: string[];
-  envLocalPaths: string[];
-  companySlug: string | null;
-  conflict: SchemaConflict | null;
-}
-
-const SLUG_RE = /^# @hqCompany\("([^"]+)"\)/m;
-
-function parseSlug(filePath: string): string | null {
-  try {
-    const content = fs.readFileSync(filePath, 'utf8');
-    const m = SLUG_RE.exec(content);
-    return m ? m[1] : null;
-  } catch {
-    return null;
-  }
-}
-
-export function discoverSchemas(cwd: string): DiscoverSchemasResult {
-  const schemaPaths: string[] = [];
-  const envLocalPaths: string[] = [];
-
-  let dir = path.resolve(cwd);
-
-  while (true) {
-    const schemaPath = path.join(dir, '.env.schema');
-    if (fs.existsSync(schemaPath)) {
-      schemaPaths.push(schemaPath);
-      const localPath = path.join(dir, '.env.local');
-      if (fs.existsSync(localPath)) {
-        envLocalPaths.push(localPath);
-      }
-    }
-
-    const isGitRoot = fs.existsSync(path.join(dir, '.git'));
-    if (isGitRoot) break;
-
-    const parent = path.dirname(dir);
-    if (parent === dir) break; // filesystem root
-    dir = parent;
-  }
-
-  // cwd-closest is pushed last during walk-up, so reversing puts it last.
-  // (During walk-up cwd is checked first → pushed first → reversed → ends up last.)
-  schemaPaths.reverse();
-  envLocalPaths.reverse();
-
-  let companySlug: string | null = null;
-  let companySlugPath: string | null = null;
-  let conflict: SchemaConflict | null = null;
-
-  for (const schemaPath of schemaPaths) {
-    const slug = parseSlug(schemaPath);
-    if (slug == null) continue;
-
-    if (companySlug == null) {
-      companySlug = slug;
-      companySlugPath = schemaPath;
-    } else if (companySlug !== slug) {
-      conflict = {
-        paths: [companySlugPath!, schemaPath],
-        slugs: [companySlug, slug],
-      };
-      companySlug = null;
-      break;
-    }
-  }
-
-  return { schemaPaths, envLocalPaths, companySlug, conflict };
-}