@indigoai-us/hq-cli 5.321.0 → 5.323.0

package/dist/utils/cli-telemetry.js

@@ -17,14 +17,17 @@ export const TELEMETRY_TIMEOUT_MS = 1_200;
  */
 export const TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when you run a signed-in command (CLI version and a timestamp, never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.";
 export const FIRST_SYNC_TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when you run a signed-in command (CLI version and a timestamp; first-sync guidance shown or followed, with the identifier cli.first-sync-next-step; never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.";
+export const CLI_INVITE_NUDGE_TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when it shows the teammate invite prompt (your company UID and whether you saw, clicked, or dismissed the prompt; no invitee details, command names, file contents, or secrets). Set HQ_TELEMETRY=0 to turn this off.";
 export const CLI_FEATURE_USED_TELEMETRY_FLAG = "cli.feature-used-telemetry-v1";
 export const CLI_FEATURE_USED_TELEMETRY_DISCLOSURE_LINE = "HQ sends a feature-use event when you run a supported CLI feature (feature kind and outcome, plus your company UID when available; never command names, file contents, or secrets). The hq-flags key cli.feature-used-telemetry-v1 controls these events. Set HQ_TELEMETRY=0 to turn this off.";
 const TELEMETRY_DISABLED_VALUES = new Set(["0", "false", "off"]);
 const DISCLOSURE_MARKER = "cli-telemetry-disclosed";
 const FIRST_SYNC_DISCLOSURE_MARKER = "cli-telemetry-disclosed-first-sync-v1";
+const INVITE_NUDGE_DISCLOSURE_MARKER = "cli-telemetry-disclosed-invite-nudge-v1";
 const FEATURE_USED_DISCLOSURE_MARKER = "cli-telemetry-disclosed-feature-used-v1";
 let cliSessionStartedPromise;
 const pendingPlanLimitInviteTeammateExposures = [];
+const pendingCliInviteNudgeEvents = [];
 export const CLI_LIMIT_AT_ACTION_PROMPT_FLAG = "billing.limit-at-action-prompt";
 const pendingCliLimitNoticeExposures = [];
 const pendingCliLimitNoticeEngagements = [];
@@ -68,6 +71,73 @@ export function queuePlanLimitInviteTeammateExposure(companyUid) {
 export function takePlanLimitInviteTeammateExposures() {
     return pendingPlanLimitInviteTeammateExposures.splice(0, pendingPlanLimitInviteTeammateExposures.length);
 }
+/** Queue one company-keyed CLI invite prompt outcome; no person UID is included in the event. */
+export function queueCliInviteNudgeEvent(companyUid, outcome) {
+    if (!/^cmp_[A-Za-z0-9_-]{1,128}$/.test(companyUid))
+        return;
+    pendingCliInviteNudgeEvents.push({ companyUid, outcome });
+}
+export function takeCliInviteNudgeEvents() {
+    return pendingCliInviteNudgeEvents.splice(0, pendingCliInviteNudgeEvents.length);
+}
+/** Emit a bounded CLI session fact through the existing product-telemetry path. */
+export async function emitCliInviteNudgeEvent(event, timeoutMs = TELEMETRY_TIMEOUT_MS) {
+    try {
+        if (isCliTelemetryDisabled())
+            return;
+        const cached = loadCachedTokens();
+        if (!cached || isExpiring(cached, 120) || !cached.accessToken ||
+            !isHumanInteractiveCliSession({
+                stdoutIsTTY: Boolean(process.stdout.isTTY),
+                argv: process.argv,
+                env: process.env,
+                machineIdentity: isMachineIdentity(),
+            }) || process.stdin.isTTY !== true)
+            return;
+        if (!maybeDiscloseInviteNudgeTelemetry())
+            return;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const response = await vaultApiFetch({
+                token: cached.accessToken,
+                path: "/v1/telemetry/events",
+                method: "POST",
+                body: {
+                    events: [{
+                            eventName: "cli_session_started",
+                            app: "hq-cli",
+                            source: "cli",
+                            occurredAt: new Date().toISOString(),
+                            consentBasis: "disclosed",
+                            schemaVersion: 1,
+                            companyUid: event.companyUid,
+                            properties: {
+                                version: CLI_VERSION,
+                                step: "invite_teammate_nudge",
+                                outcome: event.outcome,
+                            },
+                        }],
+                },
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                console.error(`hq: Could not send invite prompt telemetry (http_${response.status}).`);
+            }
+        }
+        catch (error) {
+            const errorClass = error instanceof Error ? error.name : "unknown";
+            console.error(`hq: Could not send invite prompt telemetry (${errorClass}).`);
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    catch (error) {
+        const errorClass = error instanceof Error ? error.name : "unknown";
+        console.error(`hq: Could not prepare invite prompt telemetry (${errorClass}).`);
+    }
+}
 const COMPANY_UID_PATTERN = /^cmp_[A-Za-z0-9_-]{1,128}$/;
 export function isCliLimitResourceKind(value) {
     return ["users", "integrations", "secrets", "agents", "deployments", "storageBytes"].includes(value);
@@ -172,6 +242,9 @@ export function telemetryDisclosureMarkerPath() {
 function firstSyncTelemetryDisclosureMarkerPath() {
     return path.join(hqConfigDir(), FIRST_SYNC_DISCLOSURE_MARKER);
 }
+function inviteNudgeTelemetryDisclosureMarkerPath() {
+    return path.join(hqConfigDir(), INVITE_NUDGE_DISCLOSURE_MARKER);
+}
 function featureUsedTelemetryDisclosureMarkerPath() {
     return path.join(hqConfigDir(), FEATURE_USED_DISCLOSURE_MARKER);
 }
@@ -212,6 +285,9 @@ export function maybeDiscloseCliTelemetry(stderr = process.stderr, stdout = proc
 function maybeDiscloseFirstSyncTelemetry() {
     return maybeDiscloseTelemetry(FIRST_SYNC_TELEMETRY_DISCLOSURE_LINE, firstSyncTelemetryDisclosureMarkerPath());
 }
+function maybeDiscloseInviteNudgeTelemetry() {
+    return maybeDiscloseTelemetry(CLI_INVITE_NUDGE_TELEMETRY_DISCLOSURE_LINE, inviteNudgeTelemetryDisclosureMarkerPath());
+}
 function maybeDiscloseFeatureUsedTelemetry() {
     return maybeDiscloseTelemetry(CLI_FEATURE_USED_TELEMETRY_DISCLOSURE_LINE, featureUsedTelemetryDisclosureMarkerPath());
 }

package/dist/utils/run-bundled-script.d.ts

@@ -8,10 +8,11 @@
  *
  * Deliberate choices:
  *
- *   - `stdio: "inherit"`. Not piped. Piping would buffer output that callers
- *     stream, reorder stdout against stderr, and require re-emitting bytes we
- *     have no reason to touch. Inheriting also means a script that reads stdin
- *     (the hook payload pattern) gets the real fd, unbuffered and unconsumed.
+ *   - stdio inherits by default. Captured runs pipe only stdout/stderr, and
+ *     inherit stdin unless the caller supplies an explicit payload. Piping
+ *     output would buffer streams, reorder stdout against stderr, and require
+ *     re-emitting bytes, so capture remains an explicit opt-in for native
+ *     parity fallbacks that need the shell's exact output bytes.
  *
  *   - an explicit interpreter (`bash` or `node`) rather than executing the file
  *     directly. The executable bit does survive `npm publish` for files that
@@ -52,6 +53,8 @@ export type RunBundledScriptOptions = {
     env?: Record<string, string | undefined>;
     /** Capture stdout and stderr as bytes instead of inheriting those streams. */
     captureOutput?: boolean;
+    /** Bytes supplied on stdin. With no value, stdin is inherited as before. */
+    stdin?: string | Buffer;
 };
 export type RunBundledScriptResult = {
     /** The child's exit code, or 128+signal if it was terminated by one. */

package/dist/utils/run-bundled-script.js

@@ -8,10 +8,11 @@
  *
  * Deliberate choices:
  *
- *   - `stdio: "inherit"`. Not piped. Piping would buffer output that callers
- *     stream, reorder stdout against stderr, and require re-emitting bytes we
- *     have no reason to touch. Inheriting also means a script that reads stdin
- *     (the hook payload pattern) gets the real fd, unbuffered and unconsumed.
+ *   - stdio inherits by default. Captured runs pipe only stdout/stderr, and
+ *     inherit stdin unless the caller supplies an explicit payload. Piping
+ *     output would buffer streams, reorder stdout against stderr, and require
+ *     re-emitting bytes, so capture remains an explicit opt-in for native
+ *     parity fallbacks that need the shell's exact output bytes.
  *
  *   - an explicit interpreter (`bash` or `node`) rather than executing the file
  *     directly. The executable bit does survive `npm publish` for files that
@@ -30,6 +31,7 @@
  */
 import { spawnSync } from "child_process";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "path";
 import { resolveBundledAsset } from "./hq-roots.js";
 /**
@@ -152,12 +154,41 @@ export function runBundledScript(opts) {
     if (windowsBash && !windowsBash.executable) {
         throw bashNotFoundError(opts.asset, windowsBash.cause);
     }
-    const result = spawnSync(executable, [script, ...(opts.args ?? [])], {
-        cwd: opts.cwd,
-        env,
-        stdio: opts.captureOutput ? ["inherit", "pipe", "pipe"] : "inherit",
-        ...(opts.captureOutput ? { maxBuffer: Number.MAX_SAFE_INTEGER } : {}),
-    });
+    let inputDirectory;
+    let inputDescriptor;
+    let result;
+    try {
+        if (opts.stdin !== undefined) {
+            // Some scaffold scripts reopen /dev/stdin by pathname. Node's spawnSync
+            // input pipe cannot be reopened through /dev/stdin on Linux, so capture
+            // mode supplies a private regular file descriptor to preserve that ABI.
+            const sharedMemory = process.platform === "linux" && fs.existsSync("/dev/shm")
+                ? "/dev/shm"
+                : os.tmpdir();
+            inputDirectory = fs.mkdtempSync(path.join(sharedMemory, "hq-bundled-stdin-"));
+            const inputPath = path.join(inputDirectory, "stdin");
+            fs.writeFileSync(inputPath, opts.stdin, { mode: 0o600 });
+            inputDescriptor = fs.openSync(inputPath, "r");
+        }
+        const stdinStdio = inputDescriptor ?? "inherit";
+        const stdio = opts.captureOutput
+            ? [stdinStdio, "pipe", "pipe"]
+            : inputDescriptor !== undefined
+                ? [stdinStdio, "inherit", "inherit"]
+                : "inherit";
+        result = spawnSync(executable, [script, ...(opts.args ?? [])], {
+            cwd: opts.cwd,
+            env,
+            stdio,
+            ...(opts.captureOutput ? { maxBuffer: Number.MAX_SAFE_INTEGER } : {}),
+        });
+    }
+    finally {
+        if (inputDescriptor !== undefined)
+            fs.closeSync(inputDescriptor);
+        if (inputDirectory)
+            fs.rmSync(inputDirectory, { recursive: true, force: true });
+    }
     if (result.error) {
         const spawnError = result.error;
         if (process.platform === "win32" &&
@@ -185,8 +216,12 @@ export function runBundledScript(opts) {
     return {
         code,
         ...(opts.captureOutput ? {
-            stdout: result.stdout ?? Buffer.alloc(0),
-            stderr: result.stderr ?? Buffer.alloc(0),
+            stdout: Buffer.isBuffer(result.stdout)
+                ? result.stdout
+                : Buffer.from(result.stdout ?? ""),
+            stderr: Buffer.isBuffer(result.stderr)
+                ? result.stderr
+                : Buffer.from(result.stderr ?? ""),
         } : {}),
     };
 }

package/dist/utils/vault-api.js

@@ -23,6 +23,57 @@ import { readCachedScopeUid, writeCachedScopeUid } from './secrets-cache.js';
  * whole-process watchdog.
  */
 const IDENTITY_LOOKUP_TIMEOUT_MS = 15_000;
+const LAMBDA_INVOKE_RETRY_MAX_DELAY_MS = 100;
+function isLambdaInvokeServiceError(response, bodyText) {
+    if (response.status !== 504) {
+        return false;
+    }
+    try {
+        const body = JSON.parse(bodyText);
+        return (typeof body === 'object' &&
+            body !== null &&
+            !Array.isArray(body) &&
+            Object.keys(body).length === 1 &&
+            body.message === 'Internal server error');
+    }
+    catch {
+        return false;
+    }
+}
+async function fetchWithLambdaInvokeRetry(fetchOnce, retryEligible, signal) {
+    const first = await fetchOnce();
+    if (!retryEligible || first.status !== 504)
+        return first;
+    const bodyText = await first.text();
+    if (!isLambdaInvokeServiceError(first, bodyText)) {
+        return new Response(bodyText, {
+            status: first.status,
+            statusText: first.statusText,
+            headers: first.headers,
+        });
+    }
+    const delay = 25 + Math.floor(Math.random() * (LAMBDA_INVOKE_RETRY_MAX_DELAY_MS - 24));
+    await jitteredDelayWithAbort(delay, signal);
+    return fetchOnce();
+}
+function jitteredDelayWithAbort(ms, signal) {
+    if (signal?.aborted) {
+        return Promise.reject(signal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+    }
+    return new Promise((resolve, reject) => {
+        const cleanup = () => signal?.removeEventListener('abort', abort);
+        const timer = setTimeout(() => {
+            cleanup();
+            resolve();
+        }, ms);
+        const abort = () => {
+            clearTimeout(timer);
+            cleanup();
+            reject(signal?.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+        };
+        signal?.addEventListener('abort', abort, { once: true });
+    });
+}
 /**
  * The identity-lookup abort bound, in milliseconds. Defaults to the shipped
  * IDENTITY_LOOKUP_TIMEOUT_MS (15s). An optional HQ_IDENTITY_LOOKUP_TIMEOUT_MS
@@ -192,41 +243,40 @@ export async function vaultApiFetch(opts) {
         level: "info",
         data: { url: safeUrl, method },
     });
-    let response;
-    try {
-        response = await fetch(url.toString(), {
-            method,
-            headers: {
-                Authorization: `Bearer ${opts.token}`,
-                'Content-Type': 'application/json',
-                'x-hq-client-name': HQ_CLIENT_NAME,
-                // US-003: version alongside the client family, mirroring the desktop
-                // app's client_info.rs headers, so the server can see client-version
-                // skew on EVERY authenticated request, not only health heartbeats.
-                // Fixed build constant, never caller-supplied; attribution only.
-                'x-hq-client-version': CLI_VERSION,
-                ...opts.headers,
-            },
-            body: opts.body ? JSON.stringify(opts.body) : undefined,
-            signal: opts.signal,
-        });
-    }
-    catch (err) {
-        // A transport failure never reaches the server, so the non-2xx breadcrumb
-        // below never fires and the run's last HTTP trace is the request that
-        // silently vanished (exactly what made HQ-CLI-G's event unreadable). Leave
-        // a bounded, non-secret trail — the already-redacted safeUrl plus the
-        // recognized transport code — then RE-THROW the original error untouched,
-        // so `main.ts`'s classifier stays the single decision point.
-        const code = networkTransportErrorCode(err);
-        Sentry.addBreadcrumb({
-            category: "http",
-            message: `${method} ${path} → transport error`,
-            level: "warning",
-            data: { url: safeUrl, method, ...(code ? { code } : {}) },
-        });
-        throw err;
-    }
+    const requestInit = {
+        method,
+        headers: {
+            Authorization: `Bearer ${opts.token}`,
+            'Content-Type': 'application/json',
+            'x-hq-client-name': HQ_CLIENT_NAME,
+            // US-003: version alongside the client family, mirroring the desktop
+            // app's client_info.rs headers, so the server can see client-version
+            // skew on EVERY authenticated request, not only health heartbeats.
+            // Fixed build constant, never caller-supplied; attribution only.
+            'x-hq-client-version': CLI_VERSION,
+            ...opts.headers,
+        },
+        body: opts.body ? JSON.stringify(opts.body) : undefined,
+        signal: opts.signal,
+    };
+    const fetchWithTransportBreadcrumb = async () => {
+        try {
+            return await fetch(url.toString(), requestInit);
+        }
+        catch (err) {
+            // Keep the original transport failure and its bounded, redacted trail on
+            // both the first request and the single retry.
+            const code = networkTransportErrorCode(err);
+            Sentry.addBreadcrumb({
+                category: "http",
+                message: `${method} ${path} → transport error`,
+                level: "warning",
+                data: { url: safeUrl, method, ...(code ? { code } : {}) },
+            });
+            throw err;
+        }
+    };
+    const response = await fetchWithLambdaInvokeRetry(fetchWithTransportBreadcrumb, method.toUpperCase() === 'GET' && opts.body === undefined, opts.signal);
     if (!response.ok) {
         Sentry.addBreadcrumb({
             category: "http",
@@ -287,10 +337,10 @@ export async function vaultApiFetchPublic(opts) {
         level: 'info',
         data: { url: safeUrl, method: 'GET' },
     });
-    const response = await fetch(url.toString(), {
+    const response = await fetchWithLambdaInvokeRetry(() => fetch(url.toString(), {
         method: 'GET',
         headers: { 'Content-Type': 'application/json' },
-    });
+    }), true);
     if (!response.ok) {
         Sentry.addBreadcrumb({
             category: 'http',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.321.0",
+  "version": "5.323.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {