@indigoai-us/hq-cloud 6.15.3 → 6.15.5

package/dist/outposts/self-deploy.test.js

@@ -0,0 +1,186 @@
+import { Command } from "commander";
+import { afterEach, beforeEach, describe, expect, it, vi, } from "vitest";
+import { registerOutpostsCommand } from "./command.js";
+// The box-side commands were the only thing these suites drove, but the command
+// tree now needs full host deps. Everything except the injected host-environment
+// surface is inert here (no control-plane call is made), so stub the transport
+// and token minimally and route the test's `Partial<SelfDeployDependencies>`
+// through `.host`.
+function outpostsDepsWithHost(host) {
+    return {
+        transport: async () => new Response("{}", { status: 200 }),
+        getToken: async () => "test-token",
+        loadCachedTokens: () => ({ refreshToken: "rt_test" }),
+        resolveCallerPersonUid: async () => "prs_test",
+        defaultApiBaseUrl: "https://hqapi.test.invalid",
+        host,
+    };
+}
+const AL2023 = 'ID="amzn"\nVERSION_ID="2023"\n';
+const SECRET = "refresh-token-that-must-never-be-printed";
+function successfulSpawn(stdout = "") {
+    return {
+        status: 0,
+        stdout,
+        stderr: "",
+        error: undefined,
+    };
+}
+function selfDeployDependencies(input = {}) {
+    const calls = [];
+    const deps = {
+        readTextFile: () => input.osRelease ?? AL2023,
+        loadCachedTokens: () => input.session ?? { refreshToken: SECRET },
+        getUid: () => input.uid ?? 1000,
+        isStdinTty: () => input.stdinTty ?? true,
+        confirm: async () => true,
+        defaultHqRoot: () => "/home/ec2-user/hq",
+        invokingUser: () => "ec2-user",
+        spawnSync: ((command, args, options) => {
+            calls.push({ command, args, options });
+            if (command === "uname")
+                return successfulSpawn(input.uname ?? "x86_64\n");
+            if (command === "systemctl" && args[0] === "--version") {
+                return input.systemd === false
+                    ? { ...successfulSpawn(), status: 1 }
+                    : successfulSpawn("systemd 252\n");
+            }
+            if (command === "sudo" && args[0] === "-n") {
+                return input.sudo === false ? { ...successfulSpawn(), status: 1 } : successfulSpawn();
+            }
+            return successfulSpawn();
+        }),
+    };
+    return { deps, calls };
+}
+function buildProgram(deps) {
+    const program = new Command();
+    program.name("hq").exitOverride();
+    registerOutpostsCommand(program, outpostsDepsWithHost(deps));
+    return program;
+}
+async function run(deps, args) {
+    await buildProgram(deps).parseAsync(["node", "hq", ...args]);
+}
+let exitSpy;
+let logSpy;
+let errorSpy;
+let fetchSpy;
+beforeEach(() => {
+    exitSpy = vi
+        .spyOn(process, "exit")
+        .mockImplementation((code) => {
+        throw new Error(`process.exit(${code})`);
+    });
+    logSpy = vi.spyOn(console, "log").mockImplementation(() => { });
+    errorSpy = vi.spyOn(console, "error").mockImplementation(() => { });
+    fetchSpy = vi.spyOn(globalThis, "fetch");
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+function printed() {
+    return [
+        ...logSpy.mock.calls.map((call) => call.map(String).join(" ")),
+        ...errorSpy.mock.calls.map((call) => call.map(String).join(" ")),
+    ].join("\n");
+}
+function installedCommands(calls) {
+    return calls.filter((call) => call.command === "hq" ||
+        (call.command === "sudo" &&
+            ["tee", "chmod", "systemctl"].includes(call.args[0] ?? "")));
+}
+describe("hq outposts self-deploy", () => {
+    it("is hidden from outposts help but remains invokable", async () => {
+        const { deps, calls } = selfDeployDependencies();
+        const program = buildProgram(deps);
+        const outposts = program.commands.find((command) => command.name() === "outposts");
+        expect(outposts?.helpInformation()).not.toContain("self-deploy");
+        await run(deps, ["outposts", "self-deploy", "--yes"]);
+        expect(calls).toContainEqual(expect.objectContaining({
+            command: "hq",
+            args: ["rescue", "--hq-root", "/home/ec2-user/hq", "--yes"],
+        }));
+    });
+    it("rejects non-Amazon Linux 2023 before installing anything", async () => {
+        const { deps, calls } = selfDeployDependencies({
+            osRelease: 'ID="ubuntu"\nVERSION_ID="24.04"\n',
+        });
+        await expect(run(deps, ["outposts", "self-deploy", "--yes"])).rejects.toThrow("process.exit(1)");
+        expect(printed()).toContain("Amazon Linux 2023 x86_64");
+        expect(installedCommands(calls)).toEqual([]);
+    });
+    it("rejects a host without systemd before installing anything", async () => {
+        const { deps, calls } = selfDeployDependencies({ systemd: false });
+        await expect(run(deps, ["outposts", "self-deploy", "--yes"])).rejects.toThrow("process.exit(1)");
+        expect(printed()).toContain("systemd is required");
+        expect(installedCommands(calls)).toEqual([]);
+    });
+    it("requires an existing hq login before installing anything", async () => {
+        const { deps, calls } = selfDeployDependencies({ session: undefined });
+        deps.loadCachedTokens = () => undefined;
+        await expect(run(deps, ["outposts", "self-deploy", "--yes"])).rejects.toThrow("process.exit(1)");
+        expect(printed()).toContain("hq login");
+        expect(installedCommands(calls)).toEqual([]);
+    });
+    it("aborts without a TTY or --yes before running install commands", async () => {
+        const idToken = `header.${Buffer.from(JSON.stringify({ email: "person@example.com" })).toString("base64url")}.signature`;
+        const { deps, calls } = selfDeployDependencies({
+            stdinTty: false,
+            session: { refreshToken: SECRET, idToken },
+        });
+        await expect(run(deps, ["outposts", "self-deploy"])).rejects.toThrow("process.exit(1)");
+        expect(printed()).toContain("HQ identity: person@example.com");
+        expect(printed()).toContain("SELF-HOSTED HQ outpost");
+        expect(printed()).toMatch(/pass --yes/i);
+        expect(installedCommands(calls)).toEqual([]);
+    });
+    it("installs the pinned legacy launcher without a local realtime enrollment override", async () => {
+        const { deps, calls } = selfDeployDependencies();
+        await run(deps, ["outposts", "self-deploy", "--yes"]);
+        expect(calls).toContainEqual(expect.objectContaining({
+            command: "hq",
+            args: ["rescue", "--hq-root", "/home/ec2-user/hq", "--yes"],
+        }));
+        const serviceWrite = calls.find((call) => call.command === "sudo" &&
+            call.args[0] === "tee" &&
+            call.args[1] === "/etc/systemd/system/outpost-sync.service");
+        const serviceContents = String(serviceWrite?.options?.input);
+        expect(serviceContents).toContain("User=ec2-user");
+        expect(serviceContents).toContain("WorkingDirectory=\"/home/ec2-user/hq\"");
+        expect(serviceContents).toContain("ExecStart=/usr/local/bin/outpost-sync.sh");
+        expect(serviceContents).toContain("Restart=always");
+        const scriptWrite = calls.find((call) => call.command === "sudo" &&
+            call.args[0] === "tee" &&
+            call.args[1] === "/usr/local/bin/outpost-sync.sh");
+        const scriptContents = String(scriptWrite?.options?.input);
+        expect(scriptContents).toContain("hq auth refresh");
+        expect(scriptContents).toContain(`npx -y --package=@indigoai-us/hq-cloud@6.15.1 hq-sync-runner \\
+    --companies \\
+    --direction both \\
+    --on-conflict keep \\
+    --hq-root "$HQ_ROOT" \\
+    --watch \\
+    --event-push \\
+    --poll-remote-ms 60000`);
+        expect(scriptContents).not.toContain("@latest");
+        // An Outpost cannot opt itself into V2. Eligibility is fail-closed at the
+        // server; this launcher must not introduce a local realtime bypass.
+        expect(scriptContents).not.toMatch(/--(?:enable-)?realtime(?:-sync)?\b/);
+        expect(calls).toContainEqual(expect.objectContaining({
+            command: "sudo",
+            args: ["systemctl", "enable", "--now", "outpost-sync.service"],
+        }));
+    });
+    it("never exposes session secrets or makes hq-pro requests", async () => {
+        const { deps, calls } = selfDeployDependencies({
+            session: { refreshToken: SECRET },
+        });
+        await run(deps, ["outposts", "self-deploy", "--yes"]);
+        expect(JSON.stringify(calls)).not.toContain(SECRET);
+        expect(printed()).not.toContain(SECRET);
+        expect(fetchSpy).not.toHaveBeenCalled();
+        expect(exitSpy).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=self-deploy.test.js.map

package/dist/outposts/self-deploy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-deploy.test.js","sourceRoot":"","sources":["../../src/outposts/self-deploy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,SAAS,EACT,UAAU,EACV,QAAQ,EACR,MAAM,EACN,EAAE,EACF,EAAE,GAEH,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAGvD,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,mBAAmB;AACnB,SAAS,oBAAoB,CAAC,IAAqC;IACjE,OAAO;QACL,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC1D,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QAClC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QACrD,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU;QAC9C,iBAAiB,EAAE,4BAA4B;QAC/C,IAAI;KACL,CAAC;AACJ,CAAC;AAQD,MAAM,MAAM,GAAG,gCAAgC,CAAC;AAChD,MAAM,MAAM,GAAG,0CAA0C,CAAC;AAE1D,SAAS,eAAe,CAAC,MAAM,GAAG,EAAE;IAClC,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM;QACN,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,SAAS;KACkC,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAQ5B,EAAE;IACJ,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAoC;QAC5C,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM;QAC7C,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI;QAC/B,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI;QACxC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACzB,aAAa,EAAE,GAAG,EAAE,CAAC,mBAAmB;QACxC,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU;QAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,CAAC;YAC3E,IAAI,OAAO,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC,OAAO,KAAK,KAAK;oBAC5B,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE;oBACrC,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACxF,CAAC;YACD,OAAO,eAAe,EAAE,CAAC;QAC3B,CAAC,CAAwC;KAC1C,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,IAAqC;IACzD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;IAClC,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,IAAqC,EACrC,IAAc;IAEd,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,IAAI,OAA0C,CAAC;AAC/C,IAAI,MAAwC,CAAC;AAC7C,IAAI,QAA4C,CAAC;AACjD,IAAI,QAAoC,CAAC;AAEzC,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,GAAG,EAAE;SACT,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;SACtB,kBAAkB,CAAC,CAAC,IAA6B,EAAE,EAAE;QACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAiD,CAAC;IACrD,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/D,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnE,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO;IACd,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9D,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,IAAI;QACrB,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM;YACtB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,sBAAsB,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC,CAAC;QAEnF,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAEjE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAC1B,MAAM,CAAC,gBAAgB,CAAC;YACtB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,CAAC;SAC5D,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,sBAAsB,CAAC;YAC7C,SAAS,EAAE,mCAAmC;SAC/C,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC3E,iBAAiB,CAClB,CAAC;QACF,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnE,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC3E,iBAAiB,CAClB,CAAC;QACF,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACnD,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,gBAAgB,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC;QAExC,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC3E,iBAAiB,CAClB,CAAC;QACF,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC;QACzH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,sBAAsB,CAAC;YAC7C,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE;SAC3C,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAClE,iBAAiB,CAClB,CAAC;QACF,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,sBAAsB,EAAE,CAAC;QAEjD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtD,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAC1B,MAAM,CAAC,gBAAgB,CAAC;YACtB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,CAAC;SAC5D,CAAC,CACH,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,MAAM;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;YACtB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,0CAA0C,CAC9D,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAC3B,YAAY,EAAE,OAA2C,EAAE,KAAK,CAClE,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAC5E,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QAC9E,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAEpD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,MAAM;YACvB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;YACtB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,gCAAgC,CACpD,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CAC1B,WAAW,EAAE,OAA2C,EAAE,KAAK,CACjE,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC;;;;;;;2BAOV,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAC1B,MAAM,CAAC,gBAAgB,CAAC;YACtB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,sBAAsB,CAAC;YAC7C,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;SAClC,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/outposts/session-heartbeat-bounds.test.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Payload bounding for the Outpost session heartbeat.
+ *
+ * ## Why this exists
+ *
+ * The heartbeat enumerates every Claude transcript and Codex rollout on the
+ * box. On a long-lived Outpost that is an archive, not a status: the box this
+ * was first run against had **8,258 Claude transcripts and 1,082 Codex
+ * rollouts — 9,340 sessions — of which 15 had any activity in the last 15
+ * minutes.** Publishing all of them produced a payload of roughly 1.9 MB.
+ *
+ * AWS IoT Core rejects anything over 128 KB, so the very first real publish
+ * failed with `payload larger than 131072 bytes`. Every subsequent one would
+ * have too. The heartbeat is a liveness signal; it must carry what is live.
+ *
+ * Two rules, both tested here:
+ *   1. `ended` sessions are not published — they are history, and re-sending
+ *      thousands of them every five seconds is the bug.
+ *   2. Whatever survives that filter is still bounded by BYTES, because a busy
+ *      box could exceed the limit on live sessions alone. When the bound bites
+ *      it is reported, never silent — a truncated payload that looks complete
+ *      is how you get a wrong dashboard instead of a missing one.
+ */
+export {};
+//# sourceMappingURL=session-heartbeat-bounds.test.d.ts.map

package/dist/outposts/session-heartbeat-bounds.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-heartbeat-bounds.test.d.ts","sourceRoot":"","sources":["../../src/outposts/session-heartbeat-bounds.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/outposts/session-heartbeat-bounds.test.js

@@ -0,0 +1,156 @@
+/**
+ * Payload bounding for the Outpost session heartbeat.
+ *
+ * ## Why this exists
+ *
+ * The heartbeat enumerates every Claude transcript and Codex rollout on the
+ * box. On a long-lived Outpost that is an archive, not a status: the box this
+ * was first run against had **8,258 Claude transcripts and 1,082 Codex
+ * rollouts — 9,340 sessions — of which 15 had any activity in the last 15
+ * minutes.** Publishing all of them produced a payload of roughly 1.9 MB.
+ *
+ * AWS IoT Core rejects anything over 128 KB, so the very first real publish
+ * failed with `payload larger than 131072 bytes`. Every subsequent one would
+ * have too. The heartbeat is a liveness signal; it must carry what is live.
+ *
+ * Two rules, both tested here:
+ *   1. `ended` sessions are not published — they are history, and re-sending
+ *      thousands of them every five seconds is the bug.
+ *   2. Whatever survives that filter is still bounded by BYTES, because a busy
+ *      box could exceed the limit on live sessions alone. When the bound bites
+ *      it is reported, never silent — a truncated payload that looks complete
+ *      is how you get a wrong dashboard instead of a missing one.
+ */
+import { describe, expect, it } from "vitest";
+import { DEFAULT_LIVENESS_THRESHOLDS, IOT_PAYLOAD_BUDGET_BYTES, collectSessions, } from "./session-heartbeat.js";
+const NOW = new Date("2026-07-29T12:00:00.000Z");
+const NOW_MS = NOW.getTime();
+/**
+ * A fake Claude tree with `count` transcripts, each aged `ageSecondsFor(i)`.
+ * Codex enumeration sees an empty tree.
+ */
+function claudeTreeFs(count, ageSecondsFor) {
+    const names = Array.from({ length: count }, (_, i) => `${i.toString(16).padStart(8, "0")}-aaaa-bbbb-cccc-dddddddddddd.jsonl`);
+    const ageOf = new Map();
+    names.forEach((n, i) => ageOf.set(n, ageSecondsFor(i)));
+    return {
+        async readDir(path) {
+            if (path.endsWith("/.claude/projects")) {
+                return [{ name: "-home-ec2-user-hq", isDirectory: true, isFile: false }];
+            }
+            if (path.endsWith("/.claude/projects/-home-ec2-user-hq")) {
+                return names.map((name) => ({
+                    name,
+                    isDirectory: false,
+                    isFile: true,
+                }));
+            }
+            return [];
+        },
+        async stat(path) {
+            const name = path.split("/").pop() ?? "";
+            const age = ageOf.get(name) ?? 0;
+            const mtimeMs = NOW_MS - age * 1000;
+            return { mtimeMs, birthtimeMs: mtimeMs, size: 1024 };
+        },
+        async readTextFile() {
+            return "";
+        },
+        async readBounded() {
+            // A realistic cwd/model sniff, so each record is a realistic size.
+            return JSON.stringify({
+                cwd: "/home/ec2-user/hq/repos/private/some-longish-repo-name",
+                model: "claude-opus-4-8",
+            });
+        },
+    };
+}
+const config = { personUid: "prs_01TEST", home: "/home/ec2-user", now: () => NOW };
+describe("payload bounding", () => {
+    it("publishes live sessions and drops the ended archive", async () => {
+        // 500 sessions: the first 5 active, the rest ancient — the real shape of
+        // a box that has been running for weeks.
+        const fs = claudeTreeFs(500, (i) => (i < 5 ? 2 : 60 * 60 * 24 * 30));
+        const payload = await collectSessions(config, { fs });
+        expect(payload.sessions).toHaveLength(5);
+        expect(payload.sessions.every((s) => s.status !== "ended")).toBe(true);
+    });
+    it("reports how many sessions exist, not just how many it sent", async () => {
+        const fs = claudeTreeFs(500, (i) => (i < 5 ? 2 : 60 * 60 * 24 * 30));
+        const payload = await collectSessions(config, { fs });
+        // Silent filtering reads as "this box has 5 sessions". It has 500.
+        expect(payload.totalSessions).toBe(500);
+        // `totalSessions` is optional on the payload, so coalesce rather than assert
+        // non-null: a missing count then fails this comparison instead of throwing a
+        // confusing error, which is the right outcome — an absent total IS the bug
+        // this test exists to catch.
+        expect(payload.sessions.length).toBeLessThan(payload.totalSessions ?? 0);
+    });
+    it("keeps idle sessions — only `ended` is archive", async () => {
+        // 2s → running, 5min → idle, 30d → ended.
+        const fs = claudeTreeFs(3, (i) => [2, 300, 60 * 60 * 24 * 30][i]);
+        const payload = await collectSessions(config, { fs });
+        const statuses = payload.sessions.map((s) => s.status).sort();
+        expect(statuses).toEqual(["idle", "running"]);
+    });
+    it("stays under the IoT limit even when every session is live", async () => {
+        // 5,000 sessions all active — the size bound, not the status filter, is
+        // what has to hold here.
+        const fs = claudeTreeFs(5000, () => 2);
+        const payload = await collectSessions(config, { fs });
+        const bytes = Buffer.byteLength(JSON.stringify(payload), "utf8");
+        expect(bytes).toBeLessThanOrEqual(IOT_PAYLOAD_BUDGET_BYTES);
+        // The real AWS IoT Core ceiling. The budget must leave headroom under it.
+        expect(bytes).toBeLessThan(131072);
+    });
+    it("flags truncation rather than quietly shortening the list", async () => {
+        const fs = claudeTreeFs(5000, () => 2);
+        const payload = await collectSessions(config, { fs });
+        expect(payload.truncated).toBe(true);
+        expect(payload.totalSessions).toBe(5000);
+        expect(payload.sessions.length).toBeLessThan(5000);
+    });
+    it("does not flag truncation when everything fits", async () => {
+        const fs = claudeTreeFs(3, () => 2);
+        const payload = await collectSessions(config, { fs });
+        expect(payload.truncated).toBe(false);
+        expect(payload.sessions).toHaveLength(3);
+        expect(payload.totalSessions).toBe(3);
+    });
+    it("reads transcript bodies ONLY for sessions it will publish", async () => {
+        // The enumerator statted every file AND did a 16 KiB bounded read on each,
+        // before anything was filtered. On the first real box that was 9,340 reads
+        // per tick, every 5 seconds — ~150 MB of disk for 15 useful records, on
+        // the exact resource that had already taken the machine down once.
+        const reads = [];
+        const base = claudeTreeFs(500, (i) => (i < 5 ? 2 : 60 * 60 * 24 * 30));
+        const fs = {
+            ...base,
+            async readBounded(path, maxBytes, from) {
+                reads.push(path);
+                return base.readBounded(path, maxBytes, from);
+            },
+        };
+        const payload = await collectSessions(config, { fs });
+        expect(payload.sessions).toHaveLength(5);
+        // Five live sessions ⇒ five reads, not five hundred.
+        expect(reads).toHaveLength(5);
+    });
+    it("keeps the MOST RECENTLY ACTIVE sessions when it has to choose", async () => {
+        // Index 0 is freshest, index N oldest — all still within `idle`.
+        const fs = claudeTreeFs(5000, (i) => 1 + i * (1 / 10));
+        const payload = await collectSessions(config, { fs });
+        expect(payload.truncated).toBe(true);
+        // Dropping the newest and keeping stale ones would make the live view
+        // wrong in the one way that matters.
+        const kept = payload.sessions
+            .map((s) => Date.parse(s.lastActivityAt))
+            .sort((a, b) => a - b);
+        const oldestKept = kept[0];
+        const cutoff = NOW_MS - DEFAULT_LIVENESS_THRESHOLDS.idleWithinSeconds * 1000;
+        expect(oldestKept).toBeGreaterThan(cutoff);
+        // The single freshest session must always survive.
+        expect(Math.max(...kept)).toBe(NOW_MS - 1000);
+    });
+});
+//# sourceMappingURL=session-heartbeat-bounds.test.js.map

package/dist/outposts/session-heartbeat-bounds.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-heartbeat-bounds.test.js","sourceRoot":"","sources":["../../src/outposts/session-heartbeat-bounds.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,eAAe,GAIhB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAE7B;;;GAGG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,aAAoC;IAEpC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CACtB,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,oCAAoC,CACzE,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAY;YACxB,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;gBACzD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC1B,IAAI;oBACJ,WAAW,EAAE,KAAK;oBAClB,MAAM,EAAE,IAAI;iBACb,CAAC,CAAC,CAAC;YACN,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAY;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,YAAY;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,KAAK,CAAC,WAAW;YACf,mEAAmE;YACnE,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,GAAG,EAAE,wDAAwD;gBAC7D,KAAK,EAAE,iBAAiB;aACzB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AAEnF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,yEAAyE;QACzE,yCAAyC;QACzC,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtD,mEAAmE;QACnE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,6BAA6B;QAC7B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,0CAA0C;QAC1C,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,wEAAwE;QACxE,yBAAyB;QACzB,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAEjE,MAAM,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,0EAA0E;QAC1E,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,EAAE,GAAmB;YACzB,GAAG,IAAI;YACP,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI;gBACpC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;SACF,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,qDAAqD;QACrD,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,iEAAiE;QACjE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAe,CAAC,CAAC;aACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,MAAM,GACV,MAAM,GAAG,2BAA2B,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChE,MAAM,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,mDAAmD;QACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/outposts/session-heartbeat-guard.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The no-secrets guard must catch credentials WITHOUT catching ordinary paths.
+ *
+ * Both halves matter equally, and the second is easy to get wrong. The guard
+ * throws, and a throw fails the whole tick — so a pattern that matches a
+ * legitimate directory name silently disables reporting for the entire box
+ * until that session ages out.
+ *
+ * The original marker list held `sk-` and `asia` as bare substrings. `sk-`
+ * matches `task-runner`, `flask-app`, `disk-usage`, `risk-model`. Anyone who
+ * created a repo with one of those names would have taken the heartbeat down
+ * across the box, with the service still reporting active — the exact failure
+ * shape this whole change exists to remove.
+ */
+export {};
+//# sourceMappingURL=session-heartbeat-guard.test.d.ts.map

package/dist/outposts/session-heartbeat-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-heartbeat-guard.test.d.ts","sourceRoot":"","sources":["../../src/outposts/session-heartbeat-guard.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/outposts/session-heartbeat-guard.test.js

@@ -0,0 +1,88 @@
+/**
+ * The no-secrets guard must catch credentials WITHOUT catching ordinary paths.
+ *
+ * Both halves matter equally, and the second is easy to get wrong. The guard
+ * throws, and a throw fails the whole tick — so a pattern that matches a
+ * legitimate directory name silently disables reporting for the entire box
+ * until that session ages out.
+ *
+ * The original marker list held `sk-` and `asia` as bare substrings. `sk-`
+ * matches `task-runner`, `flask-app`, `disk-usage`, `risk-model`. Anyone who
+ * created a repo with one of those names would have taken the heartbeat down
+ * across the box, with the service still reporting active — the exact failure
+ * shape this whole change exists to remove.
+ */
+import { describe, expect, it } from "vitest";
+import { assertNoSecretsInPayload, } from "./session-heartbeat.js";
+function payloadWith(over) {
+    const session = {
+        id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+        tool: "claude",
+        origin: "outpost",
+        cwd: "/home/ec2-user/hq",
+        project: "hq",
+        company: null,
+        model: "claude-opus-4-8",
+        status: "running",
+        startedAt: "2026-07-29T12:00:00.000Z",
+        lastActivityAt: "2026-07-29T12:00:00.000Z",
+        source: "/home/ec2-user/.claude/projects/-home-ec2-user-hq/x.jsonl",
+        ...over,
+    };
+    return {
+        type: "sessions",
+        origin: "outpost",
+        emittedAt: "2026-07-29T12:00:00.000Z",
+        sessions: [session],
+    };
+}
+describe("ordinary paths must never trip the guard", () => {
+    // Every one of these contains `sk-` or `asia` and would have thrown before.
+    const innocentPaths = [
+        "/home/ec2-user/hq/repos/private/task-runner",
+        "/home/ec2-user/hq/repos/public/flask-app",
+        "/home/ec2-user/hq/tools/disk-usage",
+        "/home/ec2-user/hq/models/risk-model",
+        "/home/ec2-user/hq/regions/asia-pacific",
+        "/home/ec2-user/hq/repos/private/password-manager",
+        "/home/ec2-user/hq/kiosk-display",
+    ];
+    for (const cwd of innocentPaths) {
+        it(`allows ${cwd.split("/").pop()}`, () => {
+            const project = cwd.split("/").pop();
+            expect(() => assertNoSecretsInPayload(payloadWith({ cwd, project, source: `${cwd}/s.jsonl` }))).not.toThrow();
+        });
+    }
+    it("allows a model id that merely starts with the letters sk", () => {
+        expect(() => assertNoSecretsInPayload(payloadWith({ model: "sk-lite-preview" }))).not.toThrow();
+    });
+});
+describe("real credentials must still be caught", () => {
+    const leaks = [
+        ["an Anthropic key", { model: "sk-ant-api03-AbCdEfGhIjKlMnOpQrStUv" }],
+        ["an OpenAI-style key", { model: "sk-AbCdEfGhIjKlMnOpQrStUvWxYz012345" }],
+        ["a long-lived AWS key id", { project: "AKIAIOSFODNN7EXAMPLE" }],
+        ["an STS temp key id", { project: "ASIAIOSFODNN7EXAMPLE" }],
+        ["a PEM private key", { cwd: "-----BEGIN RSA PRIVATE KEY-----" }],
+        ["an authorization header", { model: "authorization: xyz" }],
+        ["a bearer token", { model: "Bearer abcdefghijklmnop0123" }],
+        ["an instance token header", { project: "x-outpost-instance-token" }],
+        ["a refresh token field", { model: 'refresh_token="abc"' }],
+        ["a password field", { model: "password=hunter2" }],
+        ["a secret access key", { project: "secretaccesskey" }],
+        ["a session token", { project: "sessiontoken" }],
+    ];
+    for (const [what, over] of leaks) {
+        it(`rejects ${what}`, () => {
+            expect(() => assertNoSecretsInPayload(payloadWith(over))).toThrow(/refusing to publish/);
+        });
+    }
+});
+describe("non-whitelisted fields are still rejected", () => {
+    it("refuses a payload carrying an extra field", () => {
+        const p = payloadWith({});
+        p.sessions[0].transcript = "secret";
+        expect(() => assertNoSecretsInPayload(p)).toThrow(/non-whitelisted/);
+    });
+});
+//# sourceMappingURL=session-heartbeat-guard.test.js.map

package/dist/outposts/session-heartbeat-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-heartbeat-guard.test.js","sourceRoot":"","sources":["../../src/outposts/session-heartbeat-guard.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,wBAAwB,GAGzB,MAAM,wBAAwB,CAAC;AAEhC,SAAS,WAAW,CAAC,IAA2B;IAC9C,MAAM,OAAO,GAAiB;QAC5B,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,mBAAmB;QACxB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,0BAA0B;QACrC,cAAc,EAAE,0BAA0B;QAC1C,MAAM,EAAE,2DAA2D;QACnE,GAAG,IAAI;KACR,CAAC;IACF,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,0BAA0B;QACrC,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,4EAA4E;IAC5E,MAAM,aAAa,GAAG;QACpB,6CAA6C;QAC7C,0CAA0C;QAC1C,oCAAoC;QACpC,qCAAqC;QACrC,wCAAwC;QACxC,kDAAkD;QAClD,iCAAiC;KAClC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,EAAE,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE;YACxC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;YACtC,MAAM,CAAC,GAAG,EAAE,CACV,wBAAwB,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,UAAU,EAAE,CAAC,CAAC,CAClF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,EAAE,CACV,wBAAwB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CACpE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,MAAM,KAAK,GAAsC;QAC/C,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QACtE,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QACzE,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QAChE,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QAC3D,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAC;QACjE,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC5D,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAC5D,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QACrE,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC3D,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACvD,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;KACjD,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,GAAG,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAC/D,qBAAqB,CACtB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAwC,CAAC,UAAU,GAAG,QAAQ,CAAC;QAC5E,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/outposts/session-heartbeat-publisher.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Outpost on-box realtime publisher — mission-control US-009.
+ *
+ * The box already holds a Cognito session (seeded from the caller's refresh
+ * token in user-data, kept fresh by the box's auth timers — see provision.ts).
+ * This module turns that session into a `PublishPort` for the session-heartbeat
+ * emitter using the EXACT on-box credential pattern the rest of the realtime
+ * fabric uses (docs/realtime-fabric.md):
+ *
+ *   1. POST {HQAPI}/v1/realtime/credentials with the box's Cognito JWT.
+ *      The Lambda resolves the caller's `personUid` from the verified JWT
+ *      (never request input) and vends short-lived STS creds whose session
+ *      policy scopes `iot:Connect/Publish/...` to `hq/{personUid}/*` only.
+ *   2. SigV4-sign an IoT Data-plane publish with those creds to
+ *      `hq/{personUid}/sessions`.
+ *
+ * No new auth surface, no embedded long-lived key, no per-device cert — the
+ * per-identity STS session policy is the isolation boundary (US-010).
+ *
+ * The HTTP fetch + IoT client are injected so this is unit-testable without a
+ * live endpoint; `defaultRealtimeCredentialsFetcher` and the IoT publish are
+ * the production wiring.
+ */
+import { IoTDataPlaneClient } from "@aws-sdk/client-iot-data-plane";
+import type { PublishPort } from "./session-heartbeat.js";
+import { sessionsTopicForPerson } from "./session-heartbeat.js";
+/** Shape returned by `POST /v1/realtime/credentials` (mirrors the handler). */
+export interface RealtimeCredentialsResponse {
+    credentials: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken: string;
+        expiration: string;
+    };
+    iotEndpoint: string;
+    region: string;
+    /** The caller's own topic — `hq/{personUid}/...`. */
+    topic: string;
+    expiresAt: string;
+}
+/** Fetches scoped realtime credentials for the box. Injected for tests. */
+export type RealtimeCredentialsFetcher = () => Promise<RealtimeCredentialsResponse>;
+/** Ceiling on a single credentials request. */
+export declare const DEFAULT_CREDENTIALS_TIMEOUT_MS = 10000;
+/**
+ * Build the production credentials fetcher. Reads the box's current Cognito
+ * id/access token via the injected `getJwt` and POSTs it to the
+ * realtime-credentials endpoint.
+ */
+export declare function defaultRealtimeCredentialsFetcher(opts: {
+    apiBaseUrl: string;
+    getJwt: () => Promise<string>;
+    fetchImpl?: typeof fetch;
+    /** Bound the request. Defaults to {@link DEFAULT_CREDENTIALS_TIMEOUT_MS}. */
+    timeoutMs?: number;
+}): RealtimeCredentialsFetcher;
+/**
+ * Create a `PublishPort` that vends scoped creds (refreshing before expiry) and
+ * publishes the compact payload to the box's own sessions topic over MQTT/IoT.
+ *
+ * @param fetchCredentials  vends per-identity-scoped STS creds + IoT endpoint
+ * @param makeClient        builds an IoT client from creds (injected for tests)
+ * @param now               clock injection
+ */
+export declare function createIotPublishPort(opts: {
+    fetchCredentials: RealtimeCredentialsFetcher;
+    makeClient?: (args: {
+        endpoint: string;
+        region: string;
+        credentials: RealtimeCredentialsResponse["credentials"];
+    }) => IoTDataPlaneClient;
+    now?: () => Date;
+}): PublishPort;
+/** Re-export for the runner so it imports one module. */
+export { sessionsTopicForPerson };
+//# sourceMappingURL=session-heartbeat-publisher.d.ts.map

package/dist/outposts/session-heartbeat-publisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-heartbeat-publisher.d.ts","sourceRoot":"","sources":["../../src/outposts/session-heartbeat-publisher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,kBAAkB,EAEnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EACV,WAAW,EAEZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2EAA2E;AAC3E,MAAM,MAAM,0BAA0B,GAAG,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAEpF,+CAA+C;AAC/C,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,0BAA0B,CAyB7B;AAUD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,CAAC;KACzD,KAAK,kBAAkB,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,WAAW,CA8Dd;AAED,yDAAyD;AACzD,OAAO,EAAE,sBAAsB,EAAE,CAAC"}