@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/utils/table-width.js

@@ -0,0 +1,15 @@
+/**
+ * Return the largest measured cell length without passing an unbounded number
+ * of values as function arguments. Large vault tables can contain hundreds of
+ * thousands of rows, beyond the argument limit of Math.max(...values).
+ */
+export function maxLength(values, measure, floor) {
+    let maximum = floor;
+    for (const value of values) {
+        const length = measure(value);
+        if (length > maximum)
+            maximum = length;
+    }
+    return maximum;
+}
+//# sourceMappingURL=table-width.js.map

package/dist/utils/team-upgrade.d.ts

@@ -10,7 +10,7 @@ export interface TeamUpgradeOptions {
     error?: (text: string) => void;
 }
 /**
- * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * Start the owner-gated HQ Workforce Checkout flow. Stripe collects payment details
  * in its hosted browser page; the CLI never receives card data.
  */
 export declare function upgradeToTeam(opts?: TeamUpgradeOptions): Promise<string>;

package/dist/utils/team-upgrade.js

@@ -14,7 +14,7 @@ function ownerUpgradeError() {
     return Object.assign(new Error("Only a company owner can upgrade. Ask a company owner to upgrade."), { expected: true });
 }
 /**
- * Start the owner-gated HQ Team Checkout flow. Stripe collects payment details
+ * Start the owner-gated HQ Workforce Checkout flow. Stripe collects payment details
  * in its hosted browser page; the CLI never receives card data.
  */
 export async function upgradeToTeam(opts = {}) {
@@ -26,6 +26,7 @@ export async function upgradeToTeam(opts = {}) {
         method: "POST",
         body: {
             companyUid,
+            entrySurface: "cli_limit",
             successUrl: CHECKOUT_SUCCESS_URL,
             cancelUrl: CHECKOUT_CANCEL_URL,
         },
@@ -35,7 +36,7 @@ export async function upgradeToTeam(opts = {}) {
         if (response.status === 403 || /owner/i.test(`${body.error ?? ""} ${body.message ?? ""}`)) {
             throw ownerUpgradeError();
         }
-        throw Object.assign(new Error(`Could not start HQ Team checkout: ${body.error ?? body.message ?? response.statusText}`), { expected: true });
+        throw Object.assign(new Error(`Could not start HQ Workforce checkout: ${body.error ?? body.message ?? response.statusText}`), { expected: true });
     }
     const { url } = (await response.json());
     if (typeof url !== "string" || !url) {
@@ -46,7 +47,7 @@ export async function upgradeToTeam(opts = {}) {
         write(`${JSON.stringify({ url })}\n`);
         return url;
     }
-    write("Opening HQ Team checkout ($500/mo) in your browser — finish there and you're upgraded.\n");
+    write("Opening HQ Workforce checkout ($500/mo) in your browser — finish there and you're upgraded.\n");
     const skipBrowser = opts.noBrowser || (opts.headless ?? isHeadless());
     if (skipBrowser) {
         write(`Open this URL to continue: ${url}\n`);

package/dist/utils/update-command-supervisor.cjs

@@ -0,0 +1,247 @@
+"use strict";
+
+const { spawn: nativeSpawn } = require("node:child_process");
+const fs = require("node:fs");
+
+const KNOWN_NPM_ERROR_CODES = new Set([
+  "E404",
+  "EACCES",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENOTFOUND",
+  "EPERM",
+  "ETARGET",
+  "ETIMEDOUT",
+]);
+
+function windowsTaskkillArgs(pid) {
+  return ["/PID", String(pid), "/T", "/F"];
+}
+
+function errorInfo(error) {
+  return {
+    code: error && typeof error.code === "string" ? error.code : undefined,
+    detail:
+      error && typeof error.message === "string" ? error.message : String(error ?? "unknown error"),
+  };
+}
+
+function writeMarker(filename, contents, log) {
+  try {
+    fs.writeFileSync(filename, contents);
+  } catch (error) {
+    const { detail } = errorInfo(error);
+    log(`[hq update supervisor] failed to record updater status: ${detail}`);
+  }
+}
+
+function npmErrorCodeFromLine(line) {
+  const escape = String.fromCharCode(0x1b);
+  const plainLine = line.replace(new RegExp(`${escape}\\[[0-9;]*m`, "g"), "").trim();
+  const match = /^npm\s+(?:ERR!|error)\s+code\s+([A-Z0-9_]{1,32})$/i.exec(plainLine);
+  const code = match && match[1].toUpperCase();
+  return code && KNOWN_NPM_ERROR_CODES.has(code) ? code : undefined;
+}
+
+/**
+ * Spawn and supervise one package-manager update. On POSIX the detached child
+ * is its own process-group leader, so signals reach the leader and every
+ * descendant. Windows command shims run below a shell, therefore taskkill is
+ * used there to terminate the full descendant tree instead of only that shell.
+ *
+ * Dependencies are injectable to pin failure handling without requiring root
+ * privileges or a Windows host in the test suite.
+ */
+function runUpdateSupervisor(config, dependencies = {}) {
+  const spawn = dependencies.spawn || nativeSpawn;
+  const signal = dependencies.kill || process.kill.bind(process);
+  const setTimer = dependencies.setTimeout || setTimeout;
+  const clearTimer = dependencies.clearTimeout || clearTimeout;
+  const platform = dependencies.platform || process.platform;
+  const exit = dependencies.exit || ((code) => process.exit(code));
+  const log = dependencies.log || console.error;
+
+  let child;
+  let deadlineTimer;
+  let graceTimer;
+  let reapTimer;
+  let finished = false;
+  let timedOut = false;
+  let childClosed = false;
+  let treeTerminationConfirmed = false;
+  let stderrLineBuffer = "";
+  let diagnosticRecorded = false;
+
+  function inspectNpmStderrLine(line) {
+    if (diagnosticRecorded || !config.diagnosticMarker) return;
+    const code = npmErrorCodeFromLine(line);
+    if (!code) return;
+    writeMarker(config.diagnosticMarker, code, log);
+    diagnosticRecorded = true;
+  }
+
+  function inspectNpmStderrChunk(chunk) {
+    if (diagnosticRecorded || !config.diagnosticMarker) return;
+    const lines = `${stderrLineBuffer}${chunk.toString("utf8")}`.split(/\r?\n/);
+    stderrLineBuffer = lines.pop() || "";
+    for (const line of lines) inspectNpmStderrLine(line);
+    if (stderrLineBuffer.length > 128) {
+      stderrLineBuffer = stderrLineBuffer.slice(-128);
+    }
+  }
+
+  function flushNpmStderrLine() {
+    if (stderrLineBuffer) inspectNpmStderrLine(stderrLineBuffer);
+    stderrLineBuffer = "";
+  }
+
+  function clear(timer) {
+    if (timer !== undefined) clearTimer(timer);
+  }
+
+  function finish(code, options = {}) {
+    if (finished) return;
+    finished = true;
+    clear(deadlineTimer);
+    clear(graceTimer);
+    clear(reapTimer);
+    if (options.timedOut) writeMarker(config.timeoutMarker, "timed-out", log);
+    if (options.error) writeMarker(config.errorMarker, JSON.stringify(options.error), log);
+    exit(code);
+  }
+
+  function timeoutFailure(code, detail) {
+    finish(124, {
+      timedOut: true,
+      error: { code, detail },
+    });
+  }
+
+  function timeoutAfterReap() {
+    finish(124, { timedOut: true });
+  }
+
+  function waitForReap(after) {
+    if (childClosed) {
+      timeoutAfterReap();
+      return;
+    }
+    reapTimer = setTimer(() => {
+      timeoutFailure(
+        "EREAP",
+        `timed out after ${config.timeoutMs}ms and ${after} did not close the updater process`,
+      );
+    }, config.reapMs);
+  }
+
+  function signalProcessGroup(signalName) {
+    if (!child || !child.pid) {
+      timeoutFailure("ESRCH", `failed to send ${signalName}: updater has no process ID`);
+      return "failed";
+    }
+    try {
+      signal(-child.pid, signalName);
+      return "sent";
+    } catch (error) {
+      const { code, detail } = errorInfo(error);
+      if (code === "ESRCH") return "gone";
+      // An EPERM here is possible after the sudo retry: waiting would violate
+      // the deadline, while claiming the process tree was reaped would lie.
+      timeoutFailure(code, `failed to send ${signalName} to updater process group: ${detail}`);
+      return "failed";
+    }
+  }
+
+  function terminateWindowsTree() {
+    if (!child || !child.pid) {
+      timeoutFailure("ESRCH", "failed to start taskkill: updater has no process ID");
+      return;
+    }
+    let killer;
+    try {
+      killer = spawn("taskkill", windowsTaskkillArgs(child.pid), {
+        stdio: "ignore",
+        windowsHide: true,
+      });
+    } catch (error) {
+      const { code, detail } = errorInfo(error);
+      timeoutFailure(code, `failed to start taskkill for updater process tree: ${detail}`);
+      return;
+    }
+    killer.once("error", (error) => {
+      const { code, detail } = errorInfo(error);
+      timeoutFailure(code, `taskkill failed for updater process tree: ${detail}`);
+    });
+    killer.once("close", (code) => {
+      if (code !== 0) {
+        timeoutFailure("ETASKKILL", `taskkill exited ${code ?? "without a status"} for updater process tree`);
+        return;
+      }
+      treeTerminationConfirmed = true;
+      waitForReap("taskkill");
+    });
+  }
+
+  try {
+    child = spawn(config.cmd, config.args, {
+      detached: true,
+      windowsHide: true,
+      stdio: ["ignore", "inherit", config.diagnosticMarker ? "pipe" : "inherit"],
+      shell: config.shell,
+    });
+  } catch (error) {
+    const { code, detail } = errorInfo(error);
+    finish(127, { error: { code, detail } });
+    return;
+  }
+
+  child.once("error", (error) => {
+    const { code, detail } = errorInfo(error);
+    finish(127, { error: { code, detail } });
+  });
+  child.once("close", (code) => {
+    childClosed = true;
+    flushNpmStderrLine();
+    if (!timedOut) {
+      finish(code === 0 ? 0 : (code ?? 1));
+      return;
+    }
+    if (treeTerminationConfirmed) timeoutAfterReap();
+  });
+
+  if (config.diagnosticMarker && child.stderr) {
+    child.stderr.on("data", inspectNpmStderrChunk);
+    child.stderr.on("end", flushNpmStderrLine);
+    child.stderr.pipe(process.stderr);
+  }
+
+  deadlineTimer = setTimer(() => {
+    if (finished) return;
+    timedOut = true;
+    if (platform === "win32") {
+      terminateWindowsTree();
+      return;
+    }
+    const term = signalProcessGroup("SIGTERM");
+    if (term === "failed") return;
+    if (term === "gone") {
+      treeTerminationConfirmed = true;
+      waitForReap("the already-exited process group");
+      return;
+    }
+    graceTimer = setTimer(() => {
+      if (finished) return;
+      const kill = signalProcessGroup("SIGKILL");
+      if (kill === "failed") return;
+      treeTerminationConfirmed = true;
+      waitForReap(kill === "gone" ? "the already-exited process group" : "SIGKILL");
+    }, config.graceMs);
+  }, config.timeoutMs);
+}
+
+if (require.main === module) {
+  runUpdateSupervisor(JSON.parse(process.argv[2]));
+}
+
+module.exports = { runUpdateSupervisor, windowsTaskkillArgs };

package/dist/utils/upload-author.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The identity stamped onto uploaded objects (`Metadata['created-by']`,
+ * `created-by-sub`). It must be the identity the push authenticates as: a
+ * machine push on a host that also has a person signed in is the agent, never
+ * the person. The private-folder creator backfill reads `created-by-sub`.
+ */
+import type { UploadAuthor } from "@indigoai-us/hq-cloud";
+/**
+ * Resolve the upload author from the cached id token of the session the push
+ * uses. Decoded, not verified: Cognito verified it at issuance and no auth
+ * decision rides on the label. Returns undefined when that session has no
+ * cached token or the token lacks `sub`/`email`; share() then skips the stamp.
+ */
+export declare function resolveUploadAuthor(env?: NodeJS.ProcessEnv, home?: string): UploadAuthor | undefined;
+//# sourceMappingURL=upload-author.d.ts.map

package/dist/utils/upload-author.js

@@ -0,0 +1,39 @@
+/**
+ * The identity stamped onto uploaded objects (`Metadata['created-by']`,
+ * `created-by-sub`). It must be the identity the push authenticates as: a
+ * machine push on a host that also has a person signed in is the agent, never
+ * the person. The private-folder creator backfill reads `created-by-sub`.
+ */
+import * as os from "node:os";
+import { loadMachineCachedTokens, readPersonTokenFile, wantsMachineCognitoTokens, } from "./cognito-session.js";
+function authorFromIdToken(idToken) {
+    if (!idToken)
+        return undefined;
+    const parts = idToken.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        if (claims.sub && claims.email) {
+            return { userSub: claims.sub, email: claims.email };
+        }
+        return undefined;
+    }
+    catch {
+        // Unparseable claims only mean no author label; share() skips the stamp.
+        return undefined;
+    }
+}
+/**
+ * Resolve the upload author from the cached id token of the session the push
+ * uses. Decoded, not verified: Cognito verified it at issuance and no auth
+ * decision rides on the label. Returns undefined when that session has no
+ * cached token or the token lacks `sub`/`email`; share() then skips the stamp.
+ */
+export function resolveUploadAuthor(env = process.env, home = os.homedir()) {
+    const tokens = wantsMachineCognitoTokens({}, env)
+        ? loadMachineCachedTokens(home, env)
+        : readPersonTokenFile(home, env);
+    return authorFromIdToken(tokens?.idToken);
+}
+//# sourceMappingURL=upload-author.js.map

package/dist/utils/vault-api.d.ts

@@ -11,6 +11,7 @@ export interface VaultApiOptions {
     method?: string;
     body?: Record<string, unknown>;
     query?: Record<string, string>;
+    headers?: Record<string, string>;
     signal?: AbortSignal;
 }
 /**
@@ -46,6 +47,13 @@ export declare function rewritePathForApiKey(path: string): string | null;
  * authorization or request signing depends on it.
  */
 export declare const HQ_CLIENT_NAME = "@indigoai-us/hq-cli";
+type VaultApiRequestTargetOptions = Pick<VaultApiOptions, "baseUrl" | "token" | "path" | "query">;
+/**
+ * Run vaultApiFetch's synchronous, client-side request checks without sending
+ * the request. Commands with prior uploads use this to fail before creating
+ * objects that a later local refusal would leave orphaned.
+ */
+export declare function assertVaultApiRequestSupported(opts: VaultApiRequestTargetOptions): void;
 export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
 /**
  * Public (NONE-auth) GET against the vault API — no bearer token. The
@@ -59,10 +67,22 @@ export declare function vaultApiFetchPublic(opts: {
     query?: Record<string, string>;
 }): Promise<Response>;
 export declare function looksLikeCompanyUid(ref: string): boolean;
-export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+export declare function looksLikePersonVaultUid(ref: string): boolean;
+export declare function getCompanyUid(token: string, companySlug: string | undefined, 
+/**
+ * Control-plane origin for the lookups. Defaults to DEFAULT_VAULT_API_URL;
+ * pass it when the caller is bound to another API (an enrolled agent's
+ * `apiBaseUrl`) so its token never goes to the default host.
+ */
+baseUrl?: string, options?: {
+    allowOfflineScopeFallback?: boolean;
+}): Promise<string>;
 export declare function resolveCallerPersonUid(token: string, baseUrl?: string): Promise<string>;
 export declare function getEntityUid(token: string, opts: {
     personal?: boolean;
     companySlug?: string;
+}, options?: {
+    allowOfflineScopeFallback?: boolean;
 }): Promise<string>;
+export {};
 //# sourceMappingURL=vault-api.d.ts.map