@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/lib/work-context/windows-acl.js

@@ -1,425 +0,0 @@
-/**
- * Windows DACL check for the work-context config (US-018).
- *
- * NTFS has no POSIX mode bits: Node reports `mode` 0666 for every regular
- * file on win32, so the POSIX `mode & 0o022` test in config.ts can never pass
- * there. Instead of skipping the check on Windows, this module reads the real
- * DACL and refuses the config when any principal other than the current user,
- * SYSTEM, Administrators, or the owner is granted write/modify/full access.
- *
- * How the DACL is read (no native dependency):
- *   `icacls <path> /save <tmpfile>` writes the DACL as an SDDL string
- *   (`D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-...)`). SDDL carries
- *   SIDs or well-known SID abbreviations, never display names, so the check is
- *   independent of the OS language (VORDEFINIERT\Administratoren is still BA /
- *   S-1-5-32-544). The current user's SID comes from `whoami /user`. Display
- *   names are only resolved (via PowerShell) for the error message.
- *
- * Trust is decided by SID: S-1-5-18 (SYSTEM), S-1-5-32-544 (Administrators),
- * S-1-3-0 (CREATOR OWNER), S-1-3-4 (OWNER RIGHTS), the current user's SID and
- * the owner's SID when known.
- *
- * Reduced-guarantee path (explicit, documented): the check does NOT throw and
- * instead emits one stderr diagnostic that the config is unprotected on this
- * platform when, and only when, the DACL cannot be evaluated:
- *   - icacls is missing, fails, or its output has no SDDL line (unreadable);
- *   - an ACE grants write to a principal whose SID we cannot resolve (an SDDL
- *     abbreviation this module does not know), or carries a rights token we
- *     cannot decode, or the current user's SID is unknown and the grant is to
- *     a non-well-known SID (unresolvable).
- * A DACL that parses and grants write to a resolved SID outside the trusted
- * set always throws UnsafeConfigPathError. Nothing else falls back.
- */
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { spawnSync } from "node:child_process";
-import { UnsafeConfigPathError } from "./errors.js";
-// --- SIDs ---------------------------------------------------------------
-export const SID_SYSTEM = "S-1-5-18";
-export const SID_ADMINISTRATORS = "S-1-5-32-544";
-export const SID_CREATOR_OWNER = "S-1-3-0";
-export const SID_OWNER_RIGHTS = "S-1-3-4";
-/** SDDL well-known account abbreviations (subset relevant to file DACLs). */
-const SDDL_SID_ABBREVIATIONS = {
-    SY: SID_SYSTEM,
-    BA: SID_ADMINISTRATORS,
-    BU: "S-1-5-32-545", // Users
-    BG: "S-1-5-32-546", // Guests
-    PU: "S-1-5-32-547", // Power Users
-    WD: "S-1-1-0", // Everyone
-    AU: "S-1-5-11", // Authenticated Users
-    IU: "S-1-5-4", // Interactive
-    NU: "S-1-5-2", // Network
-    SU: "S-1-5-6", // Service
-    AN: "S-1-5-7", // Anonymous
-    LS: "S-1-5-19", // Local Service
-    NS: "S-1-5-20", // Network Service
-    CO: SID_CREATOR_OWNER,
-    CG: "S-1-3-1", // Creator Group
-    OW: SID_OWNER_RIGHTS,
-    RC: "S-1-5-12", // Restricted Code
-    AC: "S-1-15-2-1", // All application packages
-    DA: "S-1-5-21-<domain>-512", // Domain Admins (domain-relative; never trusted)
-    DU: "S-1-5-21-<domain>-513", // Domain Users
-    LA: "S-1-5-21-<domain>-500", // Local Administrator account
-    LG: "S-1-5-21-<domain>-501", // Local Guest account
-};
-/** Resolve an SDDL account field to a SID, or null when unknown. */
-export function sddlAccountToSid(account) {
-    const a = account.trim();
-    if (/^S-1-\d+(-\d+)+$/i.test(a))
-        return a.toUpperCase();
-    const abbr = SDDL_SID_ABBREVIATIONS[a.toUpperCase()];
-    if (!abbr || abbr.includes("<domain>"))
-        return null;
-    return abbr;
-}
-// --- rights -------------------------------------------------------------
-const FILE_WRITE_DATA = 0x2;
-const FILE_APPEND_DATA = 0x4;
-const FILE_WRITE_EA = 0x10;
-const FILE_DELETE_CHILD = 0x40;
-const FILE_WRITE_ATTRIBUTES = 0x100;
-const DELETE = 0x10000;
-const WRITE_DAC = 0x40000;
-const WRITE_OWNER = 0x80000;
-const GENERIC_ALL = 0x10000000;
-const GENERIC_WRITE = 0x40000000;
-/** Any of these bits lets the holder change the file or replace it. */
-export const WRITE_MASK = FILE_WRITE_DATA |
-    FILE_APPEND_DATA |
-    FILE_WRITE_EA |
-    FILE_DELETE_CHILD |
-    FILE_WRITE_ATTRIBUTES |
-    DELETE |
-    WRITE_DAC |
-    WRITE_OWNER |
-    GENERIC_ALL |
-    GENERIC_WRITE;
-/** SDDL rights tokens → access mask (generic + file-specific + DS bits). */
-const SDDL_RIGHTS_TOKENS = {
-    GA: GENERIC_ALL,
-    GR: 0x80000000,
-    GW: GENERIC_WRITE,
-    GX: 0x20000000,
-    FA: 0x1f01ff,
-    FR: 0x120089,
-    FW: 0x120116,
-    FX: 0x1200a0,
-    KA: 0xf003f,
-    KR: 0x20019,
-    KW: 0x20006,
-    KX: 0x20019,
-    RC: 0x20000,
-    SD: DELETE,
-    WD: WRITE_DAC,
-    WO: WRITE_OWNER,
-    RP: 0x10,
-    WP: 0x20,
-    CC: 0x1,
-    DC: 0x2,
-    LC: 0x4,
-    SW: 0x8,
-    LO: 0x80,
-    DT: 0x40,
-    CR: 0x100,
-};
-/** Decode an SDDL rights field to an access mask, or null when undecodable. */
-export function sddlRightsToMask(rights) {
-    const r = rights.trim();
-    if (!r)
-        return 0;
-    if (/^0x[0-9a-f]+$/i.test(r))
-        return Number.parseInt(r, 16) >>> 0;
-    if (/^\d+$/.test(r))
-        return Number.parseInt(r, 10) >>> 0;
-    if (r.length % 2 !== 0)
-        return null;
-    let mask = 0;
-    for (let i = 0; i < r.length; i += 2) {
-        const bits = SDDL_RIGHTS_TOKENS[r.slice(i, i + 2).toUpperCase()];
-        if (bits === undefined)
-            return null;
-        mask = (mask | bits) >>> 0;
-    }
-    return mask;
-}
-// --- parsing ------------------------------------------------------------
-/**
- * Parse the DACL portion of an SDDL string into ACEs. Accepts a full security
- * descriptor string (`O:...G:...D:...S:...`) or just the `D:` section.
- * Returns null when no DACL section is present or an ACE is malformed.
- */
-export function parseSddlDacl(sddl) {
-    const text = sddl.trim();
-    // Colons never occur inside an ACE or a SID, so section markers are unambiguous.
-    const dIdx = text.indexOf("D:");
-    if (dIdx < 0)
-        return null;
-    let body = text.slice(dIdx + 2);
-    const sIdx = body.indexOf("S:");
-    if (sIdx >= 0)
-        body = body.slice(0, sIdx);
-    // Strip DACL control flags (P, AI, AR, NO_ACCESS_CONTROL) before the first ACE.
-    const firstAce = body.indexOf("(");
-    const flags = firstAce < 0 ? body : body.slice(0, firstAce);
-    if (!/^[A-Z_]*$/i.test(flags.trim()))
-        return null;
-    if (firstAce < 0)
-        return [];
-    const aceText = body.slice(firstAce);
-    const aces = [];
-    const aceRe = /\(([^()]*)\)/g;
-    let consumed = 0;
-    let m;
-    while ((m = aceRe.exec(aceText)) !== null) {
-        if (m.index !== consumed)
-            return null; // junk between ACEs
-        consumed = m.index + m[0].length;
-        const fields = m[1].split(";");
-        if (fields.length < 6)
-            return null;
-        const [type, aceFlags, rights, , , account] = fields;
-        if (!type || !account)
-            return null;
-        aces.push({
-            type: type.trim().toUpperCase(),
-            flags: aceFlags.trim().toUpperCase(),
-            rights: rights.trim(),
-            account: account.trim(),
-        });
-    }
-    if (consumed !== aceText.trim().length)
-        return null;
-    return aces;
-}
-/**
- * Parse the file `icacls <path> /save <file>` writes: UTF-16LE (optional BOM),
- * CRLF, alternating `<name>` / `<sddl>` lines. Returns the SDDL of the first
- * entry (the target itself), or an unreadable result.
- */
-export function parseIcaclsSaveOutput(raw) {
-    let text;
-    if (Buffer.isBuffer(raw)) {
-        const hasLeBom = raw.length >= 2 && raw[0] === 0xff && raw[1] === 0xfe;
-        text = raw.toString("utf16le", hasLeBom ? 2 : 0);
-    }
-    else {
-        text = raw;
-    }
-    text = text.replace(/^\uFEFF/, "");
-    const lines = text.split(/\r?\n/).map((l) => l.trim());
-    const sddl = lines.find((l) => /^(O:|G:|D:|S:)/.test(l));
-    if (!sddl) {
-        return { readable: false, reason: "no SDDL line in icacls /save output" };
-    }
-    return { readable: true, sddl };
-}
-// --- platform readers ---------------------------------------------------
-/**
- * Absolute path of a System32 tool. PATH lookup is not safe here: Git Bash and
- * MSYS environments put a coreutils `whoami` ahead of Windows' `whoami.exe`,
- * which does not understand `/user` and would make the current user SID look
- * unknown on every run.
- */
-export function system32Tool(exe) {
-    const winDir = process.env.SystemRoot ?? process.env.windir ?? "C:\\Windows";
-    return path.join(winDir, "System32", exe);
-}
-export function readAclWithIcaclsSave(targetPath) {
-    const stamp = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-    const saveFile = path.join(os.tmpdir(), `hq-acl-${stamp}.txt`);
-    try {
-        const res = spawnSync(system32Tool("icacls.exe"), [targetPath, "/save", saveFile], {
-            encoding: "utf8",
-            windowsHide: true,
-            timeout: 10_000,
-        });
-        if (res.error) {
-            return { readable: false, reason: `icacls unavailable: ${res.error.message}` };
-        }
-        if (res.status !== 0) {
-            const stderr = String(res.stderr ?? "").trim();
-            return {
-                readable: false,
-                reason: `icacls exited ${String(res.status)}${stderr ? `: ${stderr}` : ""}`,
-            };
-        }
-        let raw;
-        try {
-            raw = fs.readFileSync(saveFile);
-        }
-        catch (err) {
-            return { readable: false, reason: `icacls /save wrote nothing: ${err.message}` };
-        }
-        return parseIcaclsSaveOutput(raw);
-    }
-    catch (err) {
-        return { readable: false, reason: `icacls failed: ${err.message}` };
-    }
-    finally {
-        try {
-            fs.rmSync(saveFile, { force: true });
-        }
-        catch {
-            // best effort
-        }
-    }
-}
-let cachedCurrentUserSid;
-/** Current user's SID via `whoami /user /fo csv /nh`; null when unavailable. */
-export function readCurrentUserSid() {
-    if (cachedCurrentUserSid !== undefined)
-        return cachedCurrentUserSid;
-    try {
-        const res = spawnSync(system32Tool("whoami.exe"), ["/user", "/fo", "csv", "/nh"], {
-            encoding: "utf8",
-            windowsHide: true,
-            timeout: 10_000,
-        });
-        const m = /"(S-1-\d+(?:-\d+)+)"/i.exec(String(res.stdout ?? ""));
-        cachedCurrentUserSid = res.status === 0 && m ? m[1].toUpperCase() : null;
-    }
-    catch {
-        cachedCurrentUserSid = null;
-    }
-    return cachedCurrentUserSid;
-}
-/** Best-effort SID → account name (only used to build error messages). */
-export function resolveSidNameWithPowerShell(sid) {
-    if (!/^S-1-\d+(-\d+)+$/i.test(sid))
-        return null;
-    try {
-        const script = `(New-Object System.Security.Principal.SecurityIdentifier('${sid}'))` +
-            `.Translate([System.Security.Principal.NTAccount]).Value`;
-        const res = spawnSync(system32Tool("WindowsPowerShell/v1.0/powershell.exe"), ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script], { encoding: "utf8", windowsHide: true, timeout: 15_000 });
-        const out = String(res.stdout ?? "").trim();
-        return res.status === 0 && out ? out : null;
-    }
-    catch {
-        return null;
-    }
-}
-// --- evaluation ---------------------------------------------------------
-/**
- * Evaluate parsed ACEs against the trusted SID set.
- * - `unsafe`: an allow ACE grants a write bit to a resolved, untrusted SID.
- * - `unresolvable`: a write-granting ACE whose SID or rights cannot be decoded,
- *   or whose SID is a per-machine/domain SID while the current user is unknown.
- * - `safe`: everything else (deny ACEs and read-only grants are ignored).
- */
-export function evaluateDacl(aces, opts) {
-    const trusted = new Set([SID_SYSTEM, SID_ADMINISTRATORS, SID_CREATOR_OWNER, SID_OWNER_RIGHTS]);
-    if (opts.currentUserSid)
-        trusted.add(opts.currentUserSid.toUpperCase());
-    if (opts.ownerSid)
-        trusted.add(opts.ownerSid.toUpperCase());
-    for (const ace of aces) {
-        if (ace.type !== "A")
-            continue; // deny / audit / object ACEs never grant
-        if (ace.flags.includes("IO"))
-            continue; // inherit-only: no effect on this object
-        const mask = sddlRightsToMask(ace.rights);
-        if (mask === null) {
-            return {
-                kind: "unresolvable",
-                reason: `cannot decode rights "${ace.rights}" for ${ace.account}`,
-            };
-        }
-        if ((mask & WRITE_MASK) === 0)
-            continue;
-        const sid = sddlAccountToSid(ace.account);
-        if (!sid) {
-            return { kind: "unresolvable", reason: `cannot resolve principal "${ace.account}" to a SID` };
-        }
-        if (trusted.has(sid))
-            continue;
-        if (!opts.currentUserSid && /^S-1-5-21-/.test(sid)) {
-            return {
-                kind: "unresolvable",
-                reason: `current user SID unknown; cannot tell whether ${sid} is the current user`,
-            };
-        }
-        return { kind: "unsafe", sid, rights: ace.rights };
-    }
-    return { kind: "safe" };
-}
-const reducedGuaranteeReported = new Set();
-/**
- * Per-process memo of non-throwing verdicts, keyed by the object's identity
- * and NTFS ChangeTime (Node `ctimeMs`), which advances whenever the DACL is
- * modified. Spawning icacls costs ~100-200ms; hooks may read the config many
- * times per process. Unsafe verdicts are never cached.
- */
-const verdictCache = new Map();
-function cacheKey(targetPath) {
-    try {
-        const st = fs.lstatSync(targetPath);
-        return { ino: st.ino, ctimeMs: st.ctimeMs };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Assert the Windows DACL of `targetPath` grants write only to trusted
- * principals. Throws UnsafeConfigPathError naming the offending principal.
- * Unreadable or unresolvable DACL → reduced-guarantee diagnostic (once per
- * path), no throw. See the module header for the exact conditions.
- */
-export function assertWindowsOwnerOnlyAcl(targetPath, kind, opts = {}) {
-    const readAcl = opts.readAcl ?? readAclWithIcaclsSave;
-    const resolveSidName = opts.resolveSidName ?? resolveSidNameWithPowerShell;
-    const diagnostic = opts.diagnostic ?? ((line) => process.stderr.write(`${line}\n`));
-    const currentUserSid = opts.currentUserSid === undefined ? readCurrentUserSid() : opts.currentUserSid;
-    const reducedGuarantee = (reason) => {
-        // Reduced-guarantee path: see module header. Deliberately not a throw.
-        if (reducedGuaranteeReported.has(targetPath))
-            return;
-        reducedGuaranteeReported.add(targetPath);
-        diagnostic(`work-context: could not evaluate Windows ACL for ${kind} ${targetPath} (${reason}); ` +
-            "config is unprotected on this platform (reduced guarantee)");
-    };
-    const key = cacheKey(targetPath);
-    const cached = key ? verdictCache.get(targetPath) : undefined;
-    if (key && cached && cached.ino === key.ino && cached.ctimeMs === key.ctimeMs)
-        return;
-    const acl = readAcl(targetPath);
-    if (!acl.readable) {
-        reducedGuarantee(acl.reason);
-        if (key)
-            verdictCache.set(targetPath, key);
-        return;
-    }
-    const aces = parseSddlDacl(acl.sddl);
-    if (aces === null) {
-        reducedGuarantee(`unparseable SDDL "${acl.sddl}"`);
-        if (key)
-            verdictCache.set(targetPath, key);
-        return;
-    }
-    const verdict = evaluateDacl(aces, { currentUserSid, ownerSid: opts.ownerSid ?? null });
-    if (verdict.kind === "safe") {
-        if (key)
-            verdictCache.set(targetPath, key);
-        return;
-    }
-    if (verdict.kind === "unresolvable") {
-        reducedGuarantee(verdict.reason);
-        if (key)
-            verdictCache.set(targetPath, key);
-        return;
-    }
-    const name = resolveSidName(verdict.sid);
-    const who = name ? `${name} (${verdict.sid})` : verdict.sid;
-    throw new UnsafeConfigPathError(`Config ${kind} ${targetPath} is writable by ${who} [rights ${verdict.rights}] ` +
-        "(expected owner-only: current user, SYSTEM, Administrators)");
-}
-/** Test hook: forget which paths already emitted the reduced-guarantee line. */
-export function resetWindowsAclDiagnostics() {
-    reducedGuaranteeReported.clear();
-    verdictCache.clear();
-    cachedCurrentUserSid = undefined;
-}
-//# sourceMappingURL=windows-acl.js.map

package/dist/lib/workers-registry/read.d.ts

@@ -1,15 +0,0 @@
-export interface RegistryWorker {
-    id: string;
-    path: string;
-    type: string;
-    visibility: string;
-    company?: string;
-    team?: string;
-    status?: string;
-    description?: string;
-    triggers?: string;
-    grants?: string;
-}
-/** Read + parse the worker registry. Empty array if it does not exist. */
-export declare function readWorkerRegistry(hqRoot: string): RegistryWorker[];
-//# sourceMappingURL=read.d.ts.map

package/dist/lib/workers-registry/read.js

@@ -1,17 +0,0 @@
-/**
- * Reader for the auto-generated core/workers/registry.yaml (see ./index.ts
- * for the generator). Lives in lib so bot code can use it without importing
- * a command module.
- */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { parseUserYaml } from "../../utils/user-yaml-error.js";
-/** Read + parse the worker registry. Empty array if it does not exist. */
-export function readWorkerRegistry(hqRoot) {
-    const p = path.join(hqRoot, "core/workers/registry.yaml");
-    if (!fs.existsSync(p))
-        return [];
-    const doc = parseUserYaml(fs.readFileSync(p, "utf8"), p);
-    return doc?.workers ?? [];
-}
-//# sourceMappingURL=read.js.map

package/dist/native-fast-route.d.ts

@@ -1,7 +0,0 @@
-/** Default-off flag check for native entrypoint routes. */
-export declare function nativeFastRouteEnabled(argv: readonly string[], env?: NodeJS.ProcessEnv): Promise<boolean>;
-/** Reads a default-off fast-route gate from its local override or fresh snapshot. */
-export declare function fastFlagEnabled(flagKey: string, env?: NodeJS.ProcessEnv, options?: {
-    numericEnvironmentOverride?: boolean;
-}): Promise<boolean>;
-//# sourceMappingURL=native-fast-route.d.ts.map

package/dist/native-fast-route.js

@@ -1,45 +0,0 @@
-/** Default-off flag check for native entrypoint routes. */
-import { localOverrideEnvVar, readLocalOverride } from "@indigoai-us/hq-flags-client";
-import { parseFastCore } from "./fast-scaffold.js";
-export async function nativeFastRouteEnabled(argv, env = process.env) {
-    const parsed = parseFastCore(argv);
-    if (!parsed || parsed.entry.kind !== "native")
-        return false;
-    return fastFlagEnabled(parsed.entry.flagKey, env);
-}
-/** Reads a default-off fast-route gate from its local override or fresh snapshot. */
-export async function fastFlagEnabled(flagKey, env = process.env, options = {}) {
-    const override = nativeRouteOverride(flagKey, env, options.numericEnvironmentOverride !== false);
-    if (override !== null)
-        return override;
-    try {
-        const [{ resolveProcessFlagCompanyContext }, { readFlagSnapshotFile }] = await Promise.all([
-            import("./lib/process-flag-company-context.js"),
-            import("./lib/flag-snapshot-file.js"),
-        ]);
-        const { companyUid } = resolveProcessFlagCompanyContext(env);
-        if (!companyUid)
-            return false;
-        return readFlagSnapshotFile(companyUid, { env })?.flags[flagKey] === true;
-    }
-    catch {
-        // The new path is a rollout optimization. Any unavailable local scope or
-        // cache data leaves the established full-graph route in control.
-        return false;
-    }
-}
-/** The route's documented CLI override also accepts the conventional 1/0. */
-function nativeRouteOverride(flagKey, env, numericEnvironmentOverride) {
-    const override = readLocalOverride(flagKey, env);
-    if (override !== null)
-        return override;
-    if (numericEnvironmentOverride) {
-        const raw = env[localOverrideEnvVar(flagKey)];
-        if (raw === "1")
-            return true;
-        if (raw === "0")
-            return false;
-    }
-    return null;
-}
-//# sourceMappingURL=native-fast-route.js.map

package/dist/node-network-compat-core.d.ts

@@ -1,12 +0,0 @@
-/** Node network defaults shared by the full graph and the selective fast path. */
-export declare const HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS = 1000;
-export interface NodeNetworkCompatibilityOptions {
-    nodeOptions?: string;
-    execArgv?: readonly string[];
-    /** Inject the net timeout setter (tests). Pass null to simulate a runtime without it. */
-    setAttemptTimeout?: ((milliseconds: number) => void) | null;
-}
-export declare function configureNodeNetworkCompatibility(options?: NodeNetworkCompatibilityOptions): boolean;
-/** Apply at most once when both entrypoint routing layers import this module. */
-export declare function configureNodeNetworkCompatibilityOnce(): boolean;
-//# sourceMappingURL=node-network-compat-core.d.ts.map

package/dist/node-network-compat-core.js

@@ -1,41 +0,0 @@
-/** Node network defaults shared by the full graph and the selective fast path. */
-import * as nodeNet from "node:net";
-export const HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS = 1000;
-const ATTEMPT_TIMEOUT_OPTION = "--network-family-autoselection-attempt-timeout";
-function hasExplicitAttemptTimeout(nodeOptions, execArgv) {
-    const optionPattern = new RegExp("(?:^|\\s)" + ATTEMPT_TIMEOUT_OPTION + "(?:=|\\s|$)");
-    return (optionPattern.test(nodeOptions) ||
-        execArgv.some((argument) => argument === ATTEMPT_TIMEOUT_OPTION ||
-            argument.startsWith(ATTEMPT_TIMEOUT_OPTION + "=")));
-}
-function resolveSetAttemptTimeout(override) {
-    if (override === null)
-        return undefined;
-    if (override)
-        return override;
-    const fn = nodeNet.setDefaultAutoSelectFamilyAttemptTimeout;
-    return typeof fn === "function" ? fn.bind(nodeNet) : undefined;
-}
-export function configureNodeNetworkCompatibility(options = {}) {
-    const nodeOptions = options.nodeOptions ?? process.env.NODE_OPTIONS ?? "";
-    const execArgv = options.execArgv ?? process.execArgv;
-    if (hasExplicitAttemptTimeout(nodeOptions, execArgv)) {
-        return false;
-    }
-    const setAttemptTimeout = resolveSetAttemptTimeout(options.setAttemptTimeout);
-    if (!setAttemptTimeout) {
-        // Runtime lacks the API; the Node preflight should already have exited.
-        return false;
-    }
-    setAttemptTimeout(HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS);
-    return true;
-}
-let configurationAttempted = false;
-/** Apply at most once when both entrypoint routing layers import this module. */
-export function configureNodeNetworkCompatibilityOnce() {
-    if (configurationAttempted)
-        return false;
-    configurationAttempted = true;
-    return configureNodeNetworkCompatibility();
-}
-//# sourceMappingURL=node-network-compat-core.js.map

package/dist/node-network-compat-fast.d.ts

@@ -1,7 +0,0 @@
-/** Selective Node network setup for the entrypoint's fast routes. */
-/**
- * Full-graph invocations keep the historical unconditional network patch.
- * Fast routes opt in only when their direct implementation uses Node networking.
- */
-export declare function shouldConfigureNodeNetworkCompatibility(argv: readonly string[]): boolean;
-//# sourceMappingURL=node-network-compat-fast.d.ts.map

package/dist/node-network-compat-fast.js

@@ -1,23 +0,0 @@
-/** Selective Node network setup for the entrypoint's fast routes. */
-import { parseFastCore, parseSecretsEnvFastRequest } from "./fast-scaffold.js";
-import { isVersionRequest, wantsLabelledVersionReport } from "./version-request.js";
-/**
- * Full-graph invocations keep the historical unconditional network patch.
- * Fast routes opt in only when their direct implementation uses Node networking.
- */
-export function shouldConfigureNodeNetworkCompatibility(argv) {
-    if (isVersionRequest(argv))
-        return wantsLabelledVersionReport(argv);
-    const fastCore = parseFastCore(argv);
-    if (fastCore)
-        return fastCore.entry.requiresNodeNetworkCompatibility === true;
-    // The lightweight secrets route still makes vault API requests.
-    if (parseSecretsEnvFastRequest(argv))
-        return true;
-    return true;
-}
-if (shouldConfigureNodeNetworkCompatibility(process.argv)) {
-    const { configureNodeNetworkCompatibilityOnce } = await import("./node-network-compat-core.js");
-    configureNodeNetworkCompatibilityOnce();
-}
-//# sourceMappingURL=node-network-compat-fast.js.map

package/dist/secrets-env-fast-path.d.ts

@@ -1,5 +0,0 @@
-import type { ParsedSecretsEnvFastRequest } from "./fast-scaffold.js";
-import type { SecretsEnvFastResult } from "./secrets-env-fast-route.js";
-/** Run the shared secret action without importing the full CLI command graph. */
-export declare function runSecretsEnvFastPath(request: ParsedSecretsEnvFastRequest): Promise<SecretsEnvFastResult>;
-//# sourceMappingURL=secrets-env-fast-path.d.ts.map

package/dist/secrets-env-fast-path.js

@@ -1,16 +0,0 @@
-/** Run the shared secret action without importing the full CLI command graph. */
-export async function runSecretsEnvFastPath(request) {
-    if (process.env.HQ_AGENT_DIR?.trim()) {
-        const [os, { agentKitPaths }, { adoptAgentIdentityEnv }] = await Promise.all([
-            import("node:os"),
-            import("./lib/agent-kit/paths.js"),
-            import("./lib/agent-kit/adopt-identity.js"),
-        ]);
-        adoptAgentIdentityEnv(agentKitPaths(os.homedir(), process.env), process.env);
-    }
-    const { runSecretsEnvCommand } = await import("./commands/secrets.js");
-    return runSecretsEnvCommand(request.options, request.scope, {
-        fallbackOnAuthFailure: true,
-    });
-}
-//# sourceMappingURL=secrets-env-fast-path.js.map

package/dist/secrets-env-fast-route.d.ts

@@ -1,18 +0,0 @@
-/** Default-off hq-flags gate for the `secrets env` entry fast path. */
-import type { ParsedSecretsEnvFastRequest } from "./fast-scaffold.js";
-export declare const CLI_SECRETS_ENV_FAST_PATH_FLAG = "cli.secrets-env-fast-path";
-export type SecretsEnvFastResult = "handled" | "fallback";
-export interface SecretsEnvFastDispatchDeps {
-    isEnabled: () => Promise<boolean>;
-    runFast: () => Promise<SecretsEnvFastResult>;
-    runCurrent: () => Promise<void>;
-}
-/** Keep the existing command graph in control when the gate is off or declines. */
-export declare function dispatchSecretsEnvFastRequest(_request: ParsedSecretsEnvFastRequest, deps: SecretsEnvFastDispatchDeps): Promise<void>;
-/**
- * Fast routes only use an explicit local override or the latest company flag
- * snapshot. A missing company, stale snapshot, or unreadable cache leaves the
- * current CLI path in control; it never performs a registry network request.
- */
-export declare function secretsEnvFastRouteEnabled(request: ParsedSecretsEnvFastRequest, env?: NodeJS.ProcessEnv): Promise<boolean>;
-//# sourceMappingURL=secrets-env-fast-route.d.ts.map