@indigoai-us/hq-cli 5.219.0 → 5.220.0

package/dist/lib/flag-registry.d.ts

@@ -17,7 +17,10 @@ interface WorkerLike {
 }
 export interface FlagRegistryDependencies {
     endpoint?: string;
-    createWorker?: (filename: URL, options: WorkerOptions) => WorkerLike;
+    createWorker?: (filename: string | URL, options: WorkerOptions) => WorkerLike;
+    /** Test seam for exercising the no-source fail-open path. */
+    workerSource?: string;
+    captureWorkerFailure?: (error: Error, tags: Record<string, string>) => void;
 }
 export interface ProcessFlagCompanyContext {
     companyUid?: string;

package/dist/lib/flag-registry.js

@@ -12,8 +12,10 @@ import { readMachineCompanyBinding } from "./work-context/company.js";
 import { readSessionState } from "./work-context/state.js";
 import { workContextRoot } from "./work-context/paths.js";
 import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
-import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
+import { loadCachedTokens, resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
+import { FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, flagRegistryStateDir, flagRegistryWorkerModeCachePath, readCachedFlagRegistryWorkerMode, writeCachedFlagRegistryWorkerMode, } from "./flag-registry-worker-mode-cache.js";
+import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
 const COMPANY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -99,6 +101,75 @@ function processSnapshotReader(companyIdentifiers) {
         },
     };
 }
+function personSubjectForWorkerMode(idToken) {
+    if (typeof idToken !== "string")
+        return null;
+    const payload = idToken.split(".")[1];
+    if (!payload)
+        return null;
+    try {
+        const subject = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).sub;
+        return typeof subject === "string" && subject.trim() ? subject : null;
+    }
+    catch {
+        Sentry.captureMessage("Could not scope cached flag-registry worker mode because the cached ID token payload is invalid", { level: "warning", tags: { component: "flag-registry-worker-mode-cache" } });
+        return null;
+    }
+}
+/** Scope a persisted rollout value to the same identity that fetched it. */
+function workerModeCacheScopes(company) {
+    const tokens = loadCachedTokens();
+    const personSubject = tokens ? personSubjectForWorkerMode(tokens.idToken) : null;
+    if (tokens && !personSubject)
+        return null;
+    return [
+        ...(company.companyUid ? [`company:${company.companyUid}`] : []),
+        ...(company.companySlug ? [`company-slug:${company.companySlug}`] : []),
+        ...(personSubject ? [`person:${personSubject}`] : []),
+    ];
+}
+function selfContainedWorkerEnabled(company) {
+    const localOverride = readLocalOverride(FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, process.env);
+    if (localOverride !== null)
+        return localOverride;
+    const scopes = workerModeCacheScopes(company);
+    if (!scopes)
+        return false;
+    const filePath = flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes);
+    try {
+        return readCachedFlagRegistryWorkerMode(filePath)?.value ?? false;
+    }
+    catch (error) {
+        Sentry.captureException(error, {
+            tags: { component: "flag-registry-worker-mode-cache", worker: "flag-registry" },
+        });
+        return false;
+    }
+}
+function cacheWorkerModeFromSnapshot(snapshot, company) {
+    // A developer's local hq-flags override is process-local and must not become
+    // the value selected by a future process.
+    if (readLocalOverride(FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, process.env) !== null)
+        return;
+    const scopes = workerModeCacheScopes(company);
+    if (!scopes)
+        return;
+    const decision = resolveFlag({
+        flagKey: FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG,
+        env: {},
+        snapshot,
+        companyIdentifiers: [company.companyUid, company.companySlug].filter((value) => Boolean(value)),
+        lookup: { fallback: false },
+    });
+    try {
+        writeCachedFlagRegistryWorkerMode(flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes), { version: snapshot.version, value: decision.value });
+    }
+    catch (error) {
+        Sentry.captureException(error, {
+            tags: { component: "flag-registry-worker-mode-cache", worker: "flag-registry" },
+        });
+    }
+}
 /**
  * Begin one registry refresh without awaiting it or retaining the CLI process.
  *
@@ -117,23 +188,43 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
     const companyIdentifiers = [companyUid, company.companySlug].filter((value) => Boolean(value));
     processReader = processSnapshotReader(companyIdentifiers);
     try {
+        let workerSource = new URL("./flag-registry-worker.js", import.meta.url);
+        let workerOptions = { workerData: {
+                endpoint,
+                ...(companyUid ? { companyUid } : {}),
+                ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
+            } };
+        if (selfContainedWorkerEnabled(company)) {
+            // The worker source is generated and embedded in this parent module at
+            // build time. It is already resident before company, identity, and cache
+            // reads can yield to an updater replacing this package tree.
+            const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
+            if (embeddedSource.length === 0) {
+                (dependencies.captureWorkerFailure ?? ((error, tags) => {
+                    Sentry.captureException(error, { tags });
+                }))(new Error("Self-contained flag-registry worker source is unavailable"), {
+                    component: "flag-registry-worker-startup",
+                    worker: "flag-registry",
+                    flag_worker_failure: "embedded_source_unavailable",
+                });
+                return processReader;
+            }
+            workerSource = embeddedSource;
+            workerOptions = { ...workerOptions, eval: true };
+        }
         // The SDK's child-process integration captures every Worker error unless
         // its process-wide captureWorkerErrors option is disabled. Scope only this
         // worker so the reporting boundary can classify its startup errors without
         // changing capture for unrelated workers.
         const worker = Sentry.withScope((scope) => {
             scope.setTag("worker", "flag-registry");
-            return (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(new URL("./flag-registry-worker.js", import.meta.url), {
-                workerData: {
-                    endpoint,
-                    ...(companyUid ? { companyUid } : {}),
-                    ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
-                },
-            });
+            return (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(workerSource, workerOptions);
         });
         worker.on("message", (value) => {
-            if (isFlagSnapshot(value))
+            if (isFlagSnapshot(value)) {
                 heldSnapshot = value;
+                cacheWorkerModeFromSnapshot(value, company);
+            }
         });
         // A failed background refresh must stay invisible to an offline CLI.
         worker.on("error", () => { });

package/dist/lib/lanes/questions.d.ts

@@ -16,7 +16,15 @@ export declare function assertQuestionBodySecretSafe(body: QuestionBody): void;
 export declare function questionRecordRefusalCode(err: unknown): "secret_text_refused" | "question_company_unavailable" | null;
 export declare function parseQuestionBodyStore(value: unknown): QuestionBodyStore;
 export declare function bodyStoreForLane(lane: Pick<LaneRecord, "company" | "mesh_company">, resolvedCompany?: LaneCompanyRef): QuestionBodyStore;
-export declare function resolveQuestionCompany(lane: Pick<LaneRecord, "lane_id" | "company" | "mesh_company">, activeCompany?: LaneCompanyRef | null): LaneCompanyRef;
+export declare function resolveQuestionCompany(lane: Pick<LaneRecord, "lane_id" | "company" | "mesh_company" | "project_id">, activeCompany?: LaneCompanyRef | null, hqRoot?: string): LaneCompanyRef;
+/**
+ * Resolve project ownership only when exactly one manifest company contains
+ * the project's directory. Multiple matches are unresolved so the caller can
+ * continue to an explicit active-company choice without picking an owner.
+ */
+export declare function resolveProjectQuestionCompany(hqRoot: string, lane: Pick<LaneRecord, "lane_id" | "project_id">): LaneCompanyRef | null;
+/** Resolve the lane/project company before lazily consulting active HQ scope. */
+export declare function resolveQuestionCompanyWithFallback(hqRoot: string, lane: Pick<LaneRecord, "lane_id" | "company" | "mesh_company" | "project_id">, resolveActiveCompany?: () => Promise<LaneCompanyRef | null>): Promise<LaneCompanyRef>;
 export declare function questionBodyRef(questionId: string): string;
 export declare function sha256Text(text: string): string;
 /** Tenant-store path for a question body (spec §6.2 / §10). Never the personal vault for company prose. */

package/dist/lib/lanes/questions.js

@@ -8,6 +8,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
 import { assertNoSecretText } from "./text-scan.js";
+import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { appendCappedHistory, createQuestion, retryUpdateQuestion, } from "./store.js";
 import { QUESTION_BODY_STORES, } from "./types.js";
 export function assertQuestionBodySecretSafe(body) {
@@ -39,13 +40,91 @@ export function parseQuestionBodyStore(value) {
 export function bodyStoreForLane(lane, resolvedCompany) {
     return lane.company || lane.mesh_company || resolvedCompany ? "company" : "personal";
 }
-export function resolveQuestionCompany(lane, activeCompany) {
-    const company = lane.company ?? lane.mesh_company ?? activeCompany;
+export function resolveQuestionCompany(lane, activeCompany, hqRoot) {
+    const laneCompany = lane.company ?? lane.mesh_company;
+    if (laneCompany !== null && laneCompany !== undefined) {
+        return requireQuestionCompany(laneCompany, lane.lane_id, "lane");
+    }
+    if (hqRoot) {
+        const projectCompany = resolveProjectQuestionCompany(hqRoot, lane);
+        if (projectCompany)
+            return projectCompany;
+    }
+    const company = activeCompany;
     if (!company || !company.slug.trim() || !company.uid.trim()) {
-        throw new LanesError("question_company_unavailable", `Cannot raise a question for lane ${lane.lane_id}: no lane, project, or active company could be resolved`, { lane_id: lane.lane_id });
+        throw new LanesError("question_company_unavailable", `Cannot raise a question for lane ${lane.lane_id}: no lane, project, or active company could be resolved`, { lane_id: lane.lane_id, resolution: "active_company_required" });
+    }
+    return company;
+}
+function requireQuestionCompany(company, laneId, source) {
+    if (!company.slug.trim() || !company.uid.trim()) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the ${source} company for lane ${laneId}: its slug or uid is missing`, { lane_id: laneId, resolution: `${source}_company_invalid` });
     }
     return company;
 }
+/**
+ * Resolve project ownership only when exactly one manifest company contains
+ * the project's directory. Multiple matches are unresolved so the caller can
+ * continue to an explicit active-company choice without picking an owner.
+ */
+export function resolveProjectQuestionCompany(hqRoot, lane) {
+    const projectId = lane.project_id?.trim();
+    if (!projectId)
+        return null;
+    if (projectId === "." || projectId === ".." || /[\\/\0]/.test(projectId)) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: its project id is invalid`, { lane_id: lane.lane_id, resolution: "project_id_invalid" });
+    }
+    const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
+    if (!fs.existsSync(manifestPath))
+        return null;
+    const companies = readCompaniesManifestMap(hqRoot);
+    if (!companies) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: companies/manifest.yaml is unreadable or malformed`, { lane_id: lane.lane_id, resolution: "company_manifest_unavailable" });
+    }
+    const matches = [];
+    for (const [slug, entry] of Object.entries(companies)) {
+        if (!entry || typeof entry !== "object" || !slug || /[\\/\0]/.test(slug))
+            continue;
+        const projectDir = path.join(hqRoot, "companies", slug, "projects", projectId);
+        let isDirectory = false;
+        try {
+            isDirectory = fs.statSync(projectDir).isDirectory();
+        }
+        catch (err) {
+            if (err.code !== "ENOENT" && err.code !== "ENOTDIR") {
+                throw new LanesError("question_company_unavailable", `Cannot verify project ownership for lane ${lane.lane_id}`, { lane_id: lane.lane_id, resolution: "project_directory_unavailable" });
+            }
+        }
+        if (!isDirectory)
+            continue;
+        const uid = typeof entry.cloud_uid === "string" ? entry.cloud_uid.trim() : "";
+        matches.push({ slug, uid });
+    }
+    if (matches.length > 1)
+        return null;
+    const match = matches[0];
+    if (!match)
+        return null;
+    if (!match.uid) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: its manifest company has no cloud uid`, { lane_id: lane.lane_id, resolution: "project_company_uid_missing" });
+    }
+    return requireQuestionCompany({ slug: match.slug, uid: match.uid }, lane.lane_id, "project");
+}
+/** Resolve the lane/project company before lazily consulting active HQ scope. */
+export async function resolveQuestionCompanyWithFallback(hqRoot, lane, resolveActiveCompany) {
+    try {
+        return resolveQuestionCompany(lane, null, hqRoot);
+    }
+    catch (err) {
+        if (!(err instanceof LanesError) ||
+            err.error !== "question_company_unavailable" ||
+            err.details.resolution !== "active_company_required" ||
+            !resolveActiveCompany) {
+            throw err;
+        }
+        return resolveQuestionCompany(lane, await resolveActiveCompany(), hqRoot);
+    }
+}
 export function questionBodyRef(questionId) {
     return path.posix.join("lanes", "questions", `${questionId}.json`);
 }
@@ -82,7 +161,7 @@ export function writeQuestionBody(hqRoot, question, body) {
  */
 export function raiseLaneQuestion(input) {
     assertQuestionBodySecretSafe(input.body);
-    const company = resolveQuestionCompany(input.lane, input.activeCompany);
+    const company = resolveQuestionCompany(input.lane, input.activeCompany, input.hqRoot);
     const store = bodyStoreForLane(input.lane, company);
     let questionId = input.questionId;
     if (!questionId) {
@@ -282,7 +361,7 @@ export function raiseEnvelopeQuestions(hqRoot, lane, envelope, envelopeRef, at,
     for (const item of presentItems) {
         assertQuestionBodySecretSafe(envelopeQuestionBody(item));
     }
-    resolveQuestionCompany(lane, activeCompany);
+    resolveQuestionCompany(lane, activeCompany, hqRoot);
     const raised = [];
     for (let i = 0; i < items.length; i += 1) {
         const item = items[i];

package/dist/lib/lanes/reconcile.js

@@ -24,7 +24,7 @@ import { readLanesRegistryFlag } from "./registry-flag.js";
 import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT, LEAD_LANE_KEEP_ALIVE_MAX_RESUMES, LEAD_LANE_KEEP_ALIVE_RESUME_TEXT, keepAliveExclusion, loadRetiredLaneIds, leadLaneKeepAliveBackoffMs, } from "./keep-alive.js";
 import { providerSupportsSessionResume } from "./delivery.js";
 import { applyDefaultQuotaHold, readQuotaSignal, recordAccountQuota } from "./quota.js";
-import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuestions, } from "./questions.js";
+import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { SILENCE_MS, classifyLaneExit, isPidAlive, missingExpectedEnvelopeFile, readLatestEnvelopeFile, readLatestEnvelopeRecord, watcherEventsPath, watcherOutLogPath, writeWatcherDecision, } from "./watcher.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshCompany, } from "./mesh-events.js";
 import { laneStories, storyStatusForEnvelope } from "./stories.js";
@@ -1054,10 +1054,8 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     latest &&
                     (latest.envelope.questions?.length ?? 0) > 0) {
                     const questionLane = readLane(hqRoot, lane.lane_id);
-                    const activeCompany = questionLane.company || questionLane.mesh_company
-                        ? undefined
-                        : await deps.resolveQuestionActiveCompany?.();
                     try {
+                        const activeCompany = await resolveQuestionCompanyWithFallback(hqRoot, questionLane, deps.resolveQuestionActiveCompany);
                         raiseEnvelopeQuestions(hqRoot, questionLane, latest.envelope, latest.ref, nowIso, undefined, activeCompany);
                     }
                     catch (err) {

package/dist/lib/lanes/watcher.js

@@ -34,7 +34,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
-import { questionRecordRefusalCode, raiseEnvelopeQuestions } from "./questions.js";
+import { questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { isTerminalLaneState, ENVELOPE_INVALID_REASON, parseLaneEnvelope, STORY_STATUSES, } from "./types.js";
 import { laneStories, storyStatusForEnvelope } from "./stories.js";
 import { readLane, retryUpdateLane } from "./store.js";
@@ -1070,12 +1070,18 @@ export async function runWatcherLoop(hqRoot, laneId, deps = {}) {
                     }
                 }
                 const terminalLane = readLane(hqRoot, laneId);
-                const activeQuestionCompany = envelope?.decision === "ask" &&
-                    (envelope.questions?.length ?? 0) > 0 &&
-                    terminalLane.company === null &&
-                    terminalLane.mesh_company === undefined
-                    ? await deps.resolveQuestionActiveCompany?.()
-                    : undefined;
+                let activeQuestionCompany;
+                if (envelope?.decision === "ask" && (envelope.questions?.length ?? 0) > 0) {
+                    try {
+                        activeQuestionCompany = await resolveQuestionCompanyWithFallback(hqRoot, terminalLane, deps.resolveQuestionActiveCompany);
+                    }
+                    catch (err) {
+                        if (questionRecordRefusalCode(err) !== "question_company_unavailable")
+                            throw err;
+                        // applyTerminalToLaneWithResult repeats the synchronous lane and
+                        // project checks, then terminalizes this ask with the named refusal.
+                    }
+                }
                 const terminalWrite = applyTerminalToLaneWithResult(hqRoot, laneId, classification, {
                     envelope,
                     envelopeRef: latest?.ref,

package/dist/sentry.js

@@ -26,6 +26,9 @@ export function epipeAwareBeforeSend(event, hint) {
             return null;
         event.level = "warning";
         event.tags = { ...event.tags, worker: "flag-registry" };
+        const missingFile = flagRegistryWorkerMissingFileTags(hint?.originalException, event);
+        if (missingFile)
+            event.tags = { ...event.tags, ...missingFile };
     }
     if (!flagRegistryWorkerEvent && isEpipe(hint?.originalException))
         return null;
@@ -123,6 +126,44 @@ function isExpectedFlagRegistryWorkerStartupFailure(error) {
     return missingModule.replaceAll("\\", "/").endsWith("/flag-registry-worker.js") ||
         missingModule === "flag-registry-worker.js";
 }
+function flagRegistryWorkerMissingFileTags(error, event) {
+    if (typeof error !== "object" || error === null)
+        return null;
+    const details = error;
+    if (details.code !== "ENOENT" || !["open", "lstat"].includes(String(details.syscall))) {
+        return null;
+    }
+    let missingPath = typeof details.path === "string" ? details.path : "";
+    if (!missingPath && typeof details.message === "string") {
+        missingPath = /\b(?:open|lstat)\s+['"]([^'"]+)['"]/.exec(details.message)?.[1] ?? "";
+    }
+    const basename = missingPath.replaceAll("\\", "/").split("/").at(-1) ?? "";
+    if (!basename)
+        return null;
+    const normalizedPath = missingPath.replaceAll("\\", "/");
+    const role = basename === "flag-registry-worker.js"
+        ? "worker_entry"
+        : normalizedPath.includes("/node_modules/")
+            ? "dependency"
+            : "other";
+    const eventText = [
+        event.message,
+        ...(event.exception?.values?.map((value) => value.value) ?? []),
+    ].filter((value) => typeof value === "string").join("\n");
+    const pathVisibility = eventText.includes(missingPath)
+        ? "full_path"
+        : eventText.includes(basename)
+            ? "basename_only"
+            : "omitted";
+    return {
+        flag_worker_load_failure: "1",
+        flag_worker_missing_basename: basename,
+        flag_worker_missing_file_role: role,
+        flag_worker_path_in_event: pathVisibility,
+        // The HQ beforeSend scrubber redacts credentials but does not strip paths.
+        flag_worker_path_scrubbed_by_hq_cli: "no",
+    };
+}
 /**
  * Tests substitute only the transport so the real SDK lifecycle can be
  * exercised without an ingest request. Production callers pass nothing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.219.0",
+  "version": "5.220.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -22,12 +22,14 @@
     "scripts/mesh-daemon-if-stale.mjs"
   ],
   "scripts": {
-    "build": "node scripts/generate-dsn.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs",
+    "build": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs",
     "prepublishOnly": "npm run build",
+    "pretypecheck": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs",
     "typecheck": "tsc --noEmit",
     "gen:scan-golden": "node scripts/generate-scan-packages-table.mjs > src/utils/__fixtures__/scan-packages.generated-block.sh",
     "gen:command-catalog": "tsc && node scripts/generate-command-catalog.mjs",
     "lint": "eslint .",
+    "pretest": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs",
     "test": "vitest run",
     "test:db": "vitest run src/lib/db test/commands/db.test.ts test/commands/db-tenant-isolation.test.ts",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
@@ -66,6 +68,7 @@
     "@vitest/coverage-v8": "4.1.6",
     "aedes": "1.1.2",
     "aws-sdk-client-mock": "^4.1.0",
+    "esbuild": "0.27.0",
     "eslint": "^10.5.0",
     "husky": "^9.1.7",
     "lint-staged": "^15.5.2",