@indigoai-us/hq-cli 5.234.1 → 5.234.2

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.234.2] — 2026-09-27
+
+### Fixed
+
+- The flag-registry worker now uses source embedded in the CLI, so package
+  updates can no longer cause startup failures by removing its script.
+
 ## [5.234.1] — 2026-09-27
 
 ### Fixed

package/dist/lib/flag-registry.js

@@ -12,9 +12,8 @@ import { readMachineCompanyBinding } from "./work-context/company.js";
 import { readSessionState } from "./work-context/state.js";
 import { workContextRoot } from "./work-context/paths.js";
 import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
-import { loadCachedTokens, resolveDefaultHqRoot } from "../utils/cognito-session.js";
+import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
-import { FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, flagRegistryWorkerModeCacheFailureContext, flagRegistryStateDir, flagRegistryWorkerModeCachePath, readCachedFlagRegistryWorkerMode, writeCachedFlagRegistryWorkerMode, } from "./flag-registry-worker-mode-cache.js";
 import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
@@ -101,86 +100,6 @@ function processSnapshotReader(companyIdentifiers) {
         },
     };
 }
-function personSubjectForWorkerMode(idToken) {
-    if (typeof idToken !== "string")
-        return null;
-    const payload = idToken.split(".")[1];
-    if (!payload)
-        return null;
-    try {
-        const subject = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).sub;
-        return typeof subject === "string" && subject.trim() ? subject : null;
-    }
-    catch {
-        Sentry.captureMessage("Could not scope cached flag-registry worker mode because the cached ID token payload is invalid", { level: "warning", tags: { component: "flag-registry-worker-mode-cache" } });
-        return null;
-    }
-}
-/** Scope a persisted rollout value to the same identity that fetched it. */
-function workerModeCacheScopes(company) {
-    const tokens = loadCachedTokens();
-    const personSubject = tokens ? personSubjectForWorkerMode(tokens.idToken) : null;
-    if (tokens && !personSubject)
-        return null;
-    return [
-        ...(company.companyUid ? [`company:${company.companyUid}`] : []),
-        ...(company.companySlug ? [`company-slug:${company.companySlug}`] : []),
-        ...(personSubject ? [`person:${personSubject}`] : []),
-    ];
-}
-function selfContainedWorkerEnabled(company) {
-    const localOverride = readLocalOverride(FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, process.env);
-    if (localOverride !== null)
-        return localOverride;
-    const scopes = workerModeCacheScopes(company);
-    if (!scopes)
-        return false;
-    const filePath = flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes);
-    try {
-        return readCachedFlagRegistryWorkerMode(filePath)?.value ?? false;
-    }
-    catch (error) {
-        const failure = flagRegistryWorkerModeCacheFailureContext(error, "read", filePath);
-        Sentry.captureException(failure.exception, {
-            tags: {
-                component: "flag-registry-worker-mode-cache",
-                worker: "flag-registry",
-                ...failure.tags,
-            },
-        });
-        return false;
-    }
-}
-function cacheWorkerModeFromSnapshot(snapshot, company) {
-    // A developer's local hq-flags override is process-local and must not become
-    // the value selected by a future process.
-    if (readLocalOverride(FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, process.env) !== null)
-        return;
-    const scopes = workerModeCacheScopes(company);
-    if (!scopes)
-        return;
-    const decision = resolveFlag({
-        flagKey: FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG,
-        env: {},
-        snapshot,
-        companyIdentifiers: [company.companyUid, company.companySlug].filter((value) => Boolean(value)),
-        lookup: { fallback: false },
-    });
-    try {
-        writeCachedFlagRegistryWorkerMode(flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes), { version: snapshot.version, value: decision.value });
-    }
-    catch (error) {
-        const filePath = flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes);
-        const failure = flagRegistryWorkerModeCacheFailureContext(error, "write", filePath);
-        Sentry.captureException(failure.exception, {
-            tags: {
-                component: "flag-registry-worker-mode-cache",
-                worker: "flag-registry",
-                ...failure.tags,
-            },
-        });
-    }
-}
 /**
  * Begin one registry refresh without awaiting it or retaining the CLI process.
  *
@@ -199,42 +118,38 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
     const companyIdentifiers = [companyUid, company.companySlug].filter((value) => Boolean(value));
     processReader = processSnapshotReader(companyIdentifiers);
     try {
-        let workerSource = new URL("./flag-registry-worker.js", import.meta.url);
-        let workerOptions = { workerData: {
+        const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
+        if (embeddedSource.length === 0) {
+            (dependencies.captureWorkerFailure ?? ((error, tags) => {
+                Sentry.captureException(error, { tags });
+            }))(new Error("Self-contained flag-registry worker source is unavailable"), {
+                component: "flag-registry-worker-startup",
+                worker: "flag-registry",
+                flag_worker_failure: "embedded_source_unavailable",
+            });
+            return processReader;
+        }
+        // This source is embedded at build time, so it remains available while an
+        // updater replaces the installed package tree.
+        const workerOptions = {
+            workerData: {
                 endpoint,
                 ...(companyUid ? { companyUid } : {}),
                 ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
-            } };
-        if (selfContainedWorkerEnabled(company)) {
-            // The worker source is generated and embedded in this parent module at
-            // build time. It is already resident before company, identity, and cache
-            // reads can yield to an updater replacing this package tree.
-            const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
-            if (embeddedSource.length === 0) {
-                (dependencies.captureWorkerFailure ?? ((error, tags) => {
-                    Sentry.captureException(error, { tags });
-                }))(new Error("Self-contained flag-registry worker source is unavailable"), {
-                    component: "flag-registry-worker-startup",
-                    worker: "flag-registry",
-                    flag_worker_failure: "embedded_source_unavailable",
-                });
-                return processReader;
-            }
-            workerSource = embeddedSource;
-            workerOptions = { ...workerOptions, eval: true };
-        }
+            },
+            eval: true,
+        };
         // The SDK's child-process integration captures every Worker error unless
         // its process-wide captureWorkerErrors option is disabled. Scope only this
         // worker so the reporting boundary can classify its startup errors without
         // changing capture for unrelated workers.
         const worker = Sentry.withScope((scope) => {
             scope.setTag("worker", "flag-registry");
-            return (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(workerSource, workerOptions);
+            return (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(embeddedSource, workerOptions);
         });
         worker.on("message", (value) => {
             if (isFlagSnapshot(value)) {
                 heldSnapshot = value;
-                cacheWorkerModeFromSnapshot(value, company);
             }
         });
         // A failed background refresh must stay invisible to an offline CLI.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.234.1",
+  "version": "5.234.2",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/dist/lib/flag-registry-worker-mode-cache.d.ts

@@ -1,20 +0,0 @@
-export declare const FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG = "cli.flag-worker-self-contained";
-interface CachedWorkerMode {
-    version: number;
-    value: boolean;
-}
-export type FlagRegistryWorkerModeCacheOperation = "read" | "write";
-export type FlagRegistryWorkerModeCacheStep = "mkdir" | "write_temp" | "link" | "unlink" | "prune" | "readdir" | "read";
-/** Build bounded filesystem diagnostics without exposing the state directory. */
-export declare function flagRegistryWorkerModeCacheFailureContext(error: unknown, operation: FlagRegistryWorkerModeCacheOperation, filePath: string, env?: NodeJS.ProcessEnv): {
-    exception: unknown;
-    tags: Record<string, string>;
-};
-/** Keep the last server snapshot decision for this one startup-mode flag. */
-export declare function flagRegistryWorkerModeCachePath(stateDir: string, scopeIdentifiers: readonly string[]): string;
-/** A missing, invalid, or inaccessible cache never enables the rollout. */
-export declare function readCachedFlagRegistryWorkerMode(filePath: string): CachedWorkerMode | null;
-export declare function writeCachedFlagRegistryWorkerMode(filePath: string, snapshot: CachedWorkerMode): void;
-export declare function flagRegistryStateDir(env?: NodeJS.ProcessEnv): string;
-export {};
-//# sourceMappingURL=flag-registry-worker-mode-cache.d.ts.map

package/dist/lib/flag-registry-worker-mode-cache.js

@@ -1,254 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-export const FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG = "cli.flag-worker-self-contained";
-class FlagRegistryWorkerModeCacheStepError extends Error {
-    cacheStep;
-    originalError;
-    constructor(cacheStep, originalError) {
-        super(`Flag registry worker-mode cache failed at ${cacheStep}`);
-        this.cacheStep = cacheStep;
-        this.originalError = originalError;
-        this.name = "FlagRegistryWorkerModeCacheStepError";
-    }
-}
-const KNOWN_ERRNOS = new Set([
-    "EACCES",
-    "EBUSY",
-    "EEXIST",
-    "EIO",
-    "EISDIR",
-    "EMFILE",
-    "ENFILE",
-    "ENOENT",
-    "ENOSPC",
-    "ENOTDIR",
-    "EPERM",
-    "EROFS",
-]);
-function withCacheFsStep(cacheStep, operation) {
-    try {
-        return operation();
-    }
-    catch (error) {
-        if (error instanceof FlagRegistryWorkerModeCacheStepError)
-            throw error;
-        throw new FlagRegistryWorkerModeCacheStepError(cacheStep, error);
-    }
-}
-function originalCacheError(error) {
-    return error instanceof FlagRegistryWorkerModeCacheStepError
-        ? error.originalError
-        : error;
-}
-function cacheErrorCode(error) {
-    const original = originalCacheError(error);
-    return typeof original === "object" && original !== null && "code" in original
-        ? original.code
-        : undefined;
-}
-function directoryHasUchg(directory) {
-    if (process.platform !== "darwin")
-        return "unknown";
-    try {
-        const rawFlags = execFileSync("/usr/bin/stat", ["-f", "%f", directory], { timeout: 1000 }).toString("utf8").trim();
-        if (!/^\d+$/.test(rawFlags))
-            return "unknown";
-        const flags = Number(rawFlags);
-        if (!Number.isSafeInteger(flags))
-            return "unknown";
-        return String((flags & 0x00000002) !== 0 || (flags & 0x00020000) !== 0);
-    }
-    catch {
-        // This bounded diagnostic is best-effort; preserve unknown and the original cache error.
-        return "unknown";
-    }
-}
-/** Build bounded filesystem diagnostics without exposing the state directory. */
-export function flagRegistryWorkerModeCacheFailureContext(error, operation, filePath, env = process.env) {
-    const cacheError = error instanceof FlagRegistryWorkerModeCacheStepError
-        ? error
-        : undefined;
-    const directory = path.dirname(filePath);
-    let dirExists = "unknown";
-    let stats;
-    try {
-        stats = fs.statSync(directory);
-        dirExists = "true";
-    }
-    catch (metadataError) {
-        if (cacheErrorCode(metadataError) === "ENOENT")
-            dirExists = "false";
-        // Keep inaccessible metadata unknown; diagnostics must not hide the cache error.
-    }
-    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
-    const ownerMatches = typeof uid === "number" && typeof stats?.uid === "number"
-        ? String(stats.uid === uid)
-        : "unknown";
-    const dirMode = typeof stats?.mode === "number"
-        ? (stats.mode & 0o777).toString(8).padStart(3, "0")
-        : "unknown";
-    const dirHasUchg = directoryHasUchg(directory);
-    const rawErrno = cacheErrorCode(error);
-    const errno = typeof rawErrno === "string" && KNOWN_ERRNOS.has(rawErrno)
-        ? rawErrno
-        : "UNKNOWN";
-    const stateDirSource = env.HQ_STATE_DIR?.trim() ? "env" : "home";
-    return {
-        exception: originalCacheError(error),
-        tags: {
-            cache_op: operation,
-            cache_step: cacheError?.cacheStep ?? (operation === "read" ? "read" : "write_temp"),
-            errno,
-            state_dir_source: stateDirSource,
-            dir_exists: dirExists,
-            dir_owner_matches_uid: ownerMatches,
-            dir_mode: dirMode,
-            dir_has_uchg: dirHasUchg,
-            cache_path_kind: "<stateDir>/flags/<basename>",
-        },
-    };
-}
-/** Keep the last server snapshot decision for this one startup-mode flag. */
-export function flagRegistryWorkerModeCachePath(stateDir, scopeIdentifiers) {
-    const basename = scopeIdentifiers.length === 0
-        ? "worker-mode-default.json"
-        : `worker-mode-${createHash("sha256")
-            .update([...scopeIdentifiers].sort().join("\0"))
-            .digest("hex")
-            .slice(0, 24)}.json`;
-    return path.join(stateDir, "flags", basename);
-}
-/** A missing, invalid, or inaccessible cache never enables the rollout. */
-export function readCachedFlagRegistryWorkerMode(filePath) {
-    let latest = readCacheRecordIfPresent(filePath);
-    const directory = path.dirname(filePath);
-    if (!withCacheFsStep("read", () => fs.existsSync(directory)))
-        return latest;
-    const basename = path.basename(filePath);
-    const versionedPrefix = `${basename}.v`;
-    for (const entry of withCacheFsStep("readdir", () => fs.readdirSync(directory))) {
-        if (!entry.startsWith(versionedPrefix) || !entry.endsWith(".json"))
-            continue;
-        const versionedPath = path.join(directory, entry);
-        const record = readCacheRecordIfPresent(versionedPath);
-        if (record)
-            latest = newerCacheRecord(latest, record);
-    }
-    return latest;
-}
-export function writeCachedFlagRegistryWorkerMode(filePath, snapshot) {
-    withCacheFsStep("mkdir", () => fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 }));
-    const existing = readCachedFlagRegistryWorkerMode(filePath);
-    if (existing && snapshot.version < existing.version)
-        return;
-    // Each registry version gets its own immutable destination. Concurrent
-    // processes can publish v7 and v8 in either order without an older value
-    // replacing the newer record.
-    const versionedPath = `${filePath}.v${snapshot.version}.json`;
-    const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
-    try {
-        withCacheFsStep("write_temp", () => fs.writeFileSync(tempPath, `${JSON.stringify(snapshot)}\n`, {
-            encoding: "utf8",
-            mode: 0o600,
-            flag: "wx",
-        }));
-        try {
-            withCacheFsStep("link", () => fs.linkSync(tempPath, versionedPath));
-        }
-        catch (error) {
-            if (!isAlreadyExistsError(error))
-                throw error;
-            const existingVersion = readCacheRecord(versionedPath);
-            if (existingVersion.value !== snapshot.value) {
-                throw new FlagRegistryWorkerModeCacheStepError("link", new Error("Conflicting flag-registry worker cache values share a version"));
-            }
-        }
-    }
-    finally {
-        if (withCacheFsStep("unlink", () => fs.existsSync(tempPath))) {
-            withCacheFsStep("unlink", () => fs.unlinkSync(tempPath));
-        }
-    }
-    pruneOlderCacheRecords(filePath);
-}
-export function flagRegistryStateDir(env = process.env) {
-    const override = env.HQ_STATE_DIR?.trim();
-    return override ? override : path.join(os.homedir(), ".hq");
-}
-function isCachedWorkerMode(value) {
-    return typeof value === "object" && value !== null &&
-        "version" in value && typeof value.version === "number" &&
-        Number.isSafeInteger(value.version) && value.version >= 0 &&
-        "value" in value && typeof value.value === "boolean";
-}
-function readCacheRecord(filePath) {
-    const contents = withCacheFsStep("read", () => fs.readFileSync(filePath, "utf8"));
-    const value = JSON.parse(contents);
-    if (!isCachedWorkerMode(value)) {
-        throw new Error("Cached flag-registry worker mode has an invalid shape");
-    }
-    return value;
-}
-function newerCacheRecord(current, candidate) {
-    if (!current || candidate.version > current.version)
-        return candidate;
-    if (candidate.version === current.version && candidate.value !== current.value) {
-        throw new Error("Conflicting flag-registry worker cache values share a version");
-    }
-    return current;
-}
-function pruneOlderCacheRecords(filePath) {
-    const latest = readCachedFlagRegistryWorkerMode(filePath);
-    if (!latest)
-        return;
-    const directory = path.dirname(filePath);
-    const basename = path.basename(filePath);
-    const versionedPrefix = `${basename}.v`;
-    for (const entry of withCacheFsStep("readdir", () => fs.readdirSync(directory))) {
-        if (!entry.startsWith(versionedPrefix) || !entry.endsWith(".json"))
-            continue;
-        const recordPath = path.join(directory, entry);
-        const record = readCacheRecordIfPresent(recordPath);
-        if (record && record.version < latest.version) {
-            try {
-                withCacheFsStep("prune", () => fs.unlinkSync(recordPath));
-            }
-            catch (error) {
-                if (!isNotFoundError(error))
-                    throw error;
-            }
-        }
-    }
-    if (withCacheFsStep("prune", () => fs.existsSync(filePath))) {
-        const legacyRecord = readCacheRecordIfPresent(filePath);
-        if (legacyRecord && legacyRecord.version < latest.version) {
-            try {
-                withCacheFsStep("prune", () => fs.unlinkSync(filePath));
-            }
-            catch (error) {
-                if (!isNotFoundError(error))
-                    throw error;
-            }
-        }
-    }
-}
-function readCacheRecordIfPresent(filePath) {
-    try {
-        return readCacheRecord(filePath);
-    }
-    catch (error) {
-        if (isNotFoundError(error))
-            return null;
-        throw error;
-    }
-}
-function isAlreadyExistsError(error) {
-    return cacheErrorCode(error) === "EEXIST";
-}
-function isNotFoundError(error) {
-    return cacheErrorCode(error) === "ENOENT";
-}
-//# sourceMappingURL=flag-registry-worker-mode-cache.js.map