@indigoai-us/hq-cli 5.103.0 → 5.103.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [5.103.1] — 2026-08-18
+
+### Fixed
+
+- `hq secrets env` now terminates deterministically instead of leaking a hung
+  process. The prior fix exited inside the stdout write callback
+  (`process.stdout.write(payload, () => process.exit(0))`), which only fires
+  once the bytes flush to a live reader. When the parent shell running
+  `source <(hq secrets env …)` was killed on timeout, the stdout pipe lost its
+  reader, the callback never fired, and the process parked forever — reparented
+  to PID 1. Hundreds accumulated on shared build hosts, exhausting swap and
+  spiking load. `env` now writes synchronously to stdout and exits
+  unconditionally, with no dependence on the event loop draining or the reader
+  still being attached (a gone reader surfaces as EPIPE and is ignored).
+
 ## [5.103.0] — 2026-08-18
 
 ### Added

package/dist/commands/secrets.d.ts

@@ -1,4 +1,5 @@
 import { Command } from "commander";
+import { writeSync } from "node:fs";
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
@@ -51,5 +52,30 @@ export declare function parseDestinationUrl(raw: string): {
 export declare function collectSecretNames(value: string, previous?: string[]): string[];
 export declare function scrubSandboxOutput(text: string, secretNames?: string[]): string;
 export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage): Promise<Map<string, string>>;
+/**
+ * Emit `hq secrets env` output and terminate deterministically.
+ *
+ * The process MUST exit even when the consuming pipe has gone away. The
+ * orphaned-process leak (personal/projects/hq-secrets-process-leak) was caused
+ * by relying on `process.stdout.write(payload, () => process.exit(0))`: when the
+ * parent shell reading `source <(hq secrets env …)` is killed on timeout, the
+ * stdout pipe loses its reader, the write callback never fires, `process.exit(0)`
+ * is never reached, and — because `env` forces no other exit — the process parks
+ * in `epoll_pwait(-1)` forever, reparented to PID 1. Hundreds accumulated this
+ * way, exhausting swap and driving load into triple digits.
+ *
+ * Writing synchronously to fd 1 and then exiting unconditionally removes every
+ * dependency on the event loop draining and on the reader still being attached:
+ * - a live reader receives the export lines (synchronous write reaches the
+ *   kernel pipe buffer before we exit, so nothing is truncated);
+ * - a dead reader surfaces as EPIPE, which we swallow — the secret is already
+ *   resolved and there is nothing left to deliver, so a clean exit is correct;
+ * - EAGAIN (stdout in non-blocking mode with a momentarily full buffer) is
+ *   retried a bounded number of times. `env` payloads are a few short export
+ *   lines, far under the 64 KiB pipe buffer, so this effectively never spins.
+ *
+ * `exit` and `write` are injectable for tests; production uses the real ones.
+ */
+export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,6 +1,7 @@
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
+import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
@@ -666,6 +667,50 @@ export async function loadRevealedSecrets(token, companyUid, keys, usage) {
         throw err;
     }
 }
+/**
+ * Emit `hq secrets env` output and terminate deterministically.
+ *
+ * The process MUST exit even when the consuming pipe has gone away. The
+ * orphaned-process leak (personal/projects/hq-secrets-process-leak) was caused
+ * by relying on `process.stdout.write(payload, () => process.exit(0))`: when the
+ * parent shell reading `source <(hq secrets env …)` is killed on timeout, the
+ * stdout pipe loses its reader, the write callback never fires, `process.exit(0)`
+ * is never reached, and — because `env` forces no other exit — the process parks
+ * in `epoll_pwait(-1)` forever, reparented to PID 1. Hundreds accumulated this
+ * way, exhausting swap and driving load into triple digits.
+ *
+ * Writing synchronously to fd 1 and then exiting unconditionally removes every
+ * dependency on the event loop draining and on the reader still being attached:
+ * - a live reader receives the export lines (synchronous write reaches the
+ *   kernel pipe buffer before we exit, so nothing is truncated);
+ * - a dead reader surfaces as EPIPE, which we swallow — the secret is already
+ *   resolved and there is nothing left to deliver, so a clean exit is correct;
+ * - EAGAIN (stdout in non-blocking mode with a momentarily full buffer) is
+ *   retried a bounded number of times. `env` payloads are a few short export
+ *   lines, far under the 64 KiB pipe buffer, so this effectively never spins.
+ *
+ * `exit` and `write` are injectable for tests; production uses the real ones.
+ */
+export function emitEnvExportsAndExit(payload, exit = process.exit, write = writeSync) {
+    const buf = Buffer.from(payload, "utf8");
+    const MAX_EAGAIN_RETRIES = 10_000;
+    let offset = 0;
+    let eagainRetries = 0;
+    while (offset < buf.length) {
+        try {
+            offset += write(1, buf, offset, buf.length - offset);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "EAGAIN" && eagainRetries++ < MAX_EAGAIN_RETRIES)
+                continue;
+            // EPIPE (reader gone) or retries exhausted: the output cannot be
+            // delivered, but the process must never hang. Stop and exit cleanly.
+            break;
+        }
+    }
+    return exit(0);
+}
 export function registerSecretsCommand(program) {
     const secrets = program
         .command("secrets")
@@ -1408,16 +1453,10 @@ export function registerSecretsCommand(program) {
                 const out = redact ? "[REDACTED]" : value;
                 payload += `export ${key}=${shellSingleQuote(out)}\n`;
             }
-            // Deterministically terminate once stdout has flushed. Unlike `exec`
-            // (which exits on its child's close), `env` has nothing to exit on and
-            // otherwise relies on the event loop draining — so a single lingering
-            // handle (e.g. a slow keep-alive socket to the vault) would keep this
-            // process alive forever, the mechanism behind the orphaned-process leak.
-            // Exit inside the write callback, which fires only after the bytes reach
-            // the pipe/file, so a `source <(hq secrets env …)` consumer never loses
-            // the export lines — a bare process.exit() would truncate buffered
-            // stdout on a pipe.
-            process.stdout.write(payload, () => process.exit(0));
+            // Write synchronously and exit unconditionally — never depend on the
+            // event loop draining or the stdout write callback firing. See
+            // emitEnvExportsAndExit for the full rationale (orphaned-process leak).
+            emitEnvExportsAndExit(payload);
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.103.0",
+  "version": "5.103.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {