@indigoai-us/hq-cli 5.322.0 → 5.323.0

package/dist/lib/cli-invite-nudge.js

@@ -0,0 +1,152 @@
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { createInterface } from "node:readline/promises";
+import { isExpiring, isMachineIdentity, loadCachedTokens, } from "../utils/cognito-session.js";
+import { queueCliInviteNudgeEvent } from "../utils/cli-telemetry.js";
+import { resolveCompanyFlagGate } from "./flag-registry.js";
+import { isHumanInteractiveCliSession } from "./first-sync-next-step.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+export const CLI_INVITE_NUDGE_FLAG = "cli.first-sync-invite-teammate-v1";
+function reportFailure(operation, error) {
+    const name = error instanceof Error ? error.name : "unknown";
+    const code = /^[A-Za-z][A-Za-z0-9]{0,39}$/.test(name) ? name : "unknown";
+    console.error(`hq: Could not ${operation} (${code}); invite prompt stays hidden.`);
+}
+/** One eligible, successful work-bearing company sync can show one prompt per company. */
+export async function runCliInviteNudge(input) {
+    if (!input.interactive || !input.canPrompt || input.alreadyShown || !/^cmp_[A-Za-z0-9_-]{1,128}$/.test(input.companyUid)) {
+        return false;
+    }
+    let enabled;
+    try {
+        enabled = await input.flagEnabled();
+    }
+    catch (error) {
+        (input.reportFailure ?? reportFailure)("resolve the invite flag", error);
+        return false;
+    }
+    if (!enabled)
+        return false;
+    let humanMemberCount;
+    try {
+        humanMemberCount = await input.readHumanMemberCount();
+    }
+    catch (error) {
+        (input.reportFailure ?? reportFailure)("check company membership", error);
+        return false;
+    }
+    if (humanMemberCount !== 1 || !input.claimShown())
+        return false;
+    input.write("Your company has one member. Invite a teammate to share the workspace.");
+    input.record(input.companyUid, "shown");
+    let clicked;
+    try {
+        clicked = await input.ask("Show the existing invite command? [y/N] ");
+    }
+    catch (error) {
+        (input.reportFailure ?? reportFailure)("read the invite choice", error);
+        return true;
+    }
+    input.record(input.companyUid, clicked ? "clicked" : "dismissed");
+    if (clicked) {
+        input.write(`Run: hq members invite <email> --company ${input.companyRef} --role member`);
+    }
+    return true;
+}
+function inviteNudgeMarkerPath(companyUid, home = process.env.HOME?.trim() || os.homedir()) {
+    const digest = createHash("sha256").update(companyUid).digest("hex");
+    return path.join(home, ".hq", "cli-invite-nudge", `${digest}.shown`);
+}
+function markerExists(companyUid) {
+    try {
+        return fs.existsSync(inviteNudgeMarkerPath(companyUid));
+    }
+    catch (error) {
+        reportFailure("read invite prompt state", error);
+        return true;
+    }
+}
+function claimMarker(companyUid) {
+    const marker = inviteNudgeMarkerPath(companyUid);
+    const homeHq = path.join(process.env.HOME?.trim() || os.homedir(), ".hq");
+    try {
+        // Do not create ~/.hq for a machine without a signed-in person profile.
+        if (!fs.existsSync(homeHq))
+            return false;
+        fs.mkdirSync(path.dirname(marker), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(marker, `${new Date().toISOString()}\n`, { flag: "wx", mode: 0o600 });
+        return true;
+    }
+    catch (error) {
+        if (typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST") {
+            return false;
+        }
+        reportFailure("write invite prompt state", error);
+        return false;
+    }
+}
+async function readActiveHumanMemberCount(accessToken, companyUid) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 1_200);
+    try {
+        const response = await vaultApiFetch({
+            token: accessToken,
+            path: `/membership/company/${encodeURIComponent(companyUid)}`,
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            throw new Error(`http_${response.status}`);
+        const body = await response.json();
+        if (!Array.isArray(body.members))
+            throw new Error("invalid_roster_shape");
+        return body.members.filter((member) => typeof member === "object" && member !== null &&
+            member.status === "active" &&
+            typeof member.personUid === "string" &&
+            member.personUid.startsWith("prs_")).length;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function askInviteChoice(prompt) {
+    const terminal = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await terminal.question(prompt);
+        return answer.trim().toLowerCase() === "y";
+    }
+    finally {
+        terminal.close();
+    }
+}
+/** Called after a successful work-bearing company sync; every dependency remains fail-closed. */
+export async function maybeShowCliInviteNudge(input) {
+    const companyUid = input.companyUid?.trim() ?? "";
+    const companyRef = input.companyRef?.trim() ?? "";
+    if (!companyUid || !companyRef)
+        return false;
+    const cached = loadCachedTokens();
+    if (!cached || isExpiring(cached, 120) ||
+        !isHumanInteractiveCliSession({
+            stdoutIsTTY: Boolean(process.stdout.isTTY),
+            argv: process.argv,
+            env: process.env,
+            machineIdentity: isMachineIdentity(),
+        }))
+        return false;
+    return runCliInviteNudge({
+        companyUid,
+        companyRef,
+        interactive: true,
+        canPrompt: process.stdin.isTTY === true,
+        alreadyShown: markerExists(companyUid),
+        flagEnabled: () => resolveCompanyFlagGate(companyUid, cached.idToken ?? "", CLI_INVITE_NUDGE_FLAG, { fallback: false }, () => false),
+        readHumanMemberCount: () => readActiveHumanMemberCount(input.accessToken, companyUid),
+        claimShown: () => claimMarker(companyUid),
+        ask: askInviteChoice,
+        write: (line) => console.log(line),
+        record: queueCliInviteNudgeEvent,
+    });
+}
+//# sourceMappingURL=cli-invite-nudge.js.map

package/dist/lib/first-sync-next-step.d.ts

@@ -12,7 +12,15 @@ export declare function shouldConfirmFirstWorkBearingSync(input: {
     alreadyCompleted: boolean;
     workBearing: boolean;
 }): boolean;
-export declare function isWorkBearingSyncResult(result: Record<string, unknown>): boolean;
+interface WorkBearingSyncResult {
+    aborted?: unknown;
+    filesUploaded?: unknown;
+    filesDownloaded?: unknown;
+    sessionLogUploadedCount?: unknown;
+    filesDeleted?: unknown;
+    tombstonedCount?: unknown;
+}
+export declare function isWorkBearingSyncResult(result: WorkBearingSyncResult): boolean;
 export declare function isHumanInteractiveCliSession(input: {
     stdoutIsTTY: boolean;
     argv: readonly string[];
@@ -31,4 +39,5 @@ export declare function maybeShowFirstSyncNextStep(): boolean;
 export declare function recordFirstWorkBearingSync(result: Record<string, unknown>): boolean;
 /** Drain outcomes once so each shown/followed event is sent at most once per run. */
 export declare function takeFirstSyncStepOutcomes(): FirstSyncStepOutcome[];
+export {};
 //# sourceMappingURL=first-sync-next-step.d.ts.map

package/dist/main.js

@@ -44,7 +44,7 @@ import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
 import { autoUpdateAndReexec } from "./utils/self-update.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { findLazyCommand, registerCommandCatalog } from "./lazy-commands.js";
-import { emitCliFirstSyncNextStepOutcome, emitCliLimitNoticeEngagement, emitCliLimitNoticeExposure, emitCliSessionStarted, emitPlanLimitInviteTeammateExposure, isCliLimitResourceKind, queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, takeFirstSyncStepOutcomes, takeCliLimitNoticeEngagements, takeCliLimitNoticeExposures, takePlanLimitInviteTeammateExposures, maybeShowFirstSyncNextStep, } from "./utils/cli-telemetry.js";
+import { emitCliFirstSyncNextStepOutcome, emitCliLimitNoticeEngagement, emitCliLimitNoticeExposure, emitCliInviteNudgeEvent, emitCliSessionStarted, emitPlanLimitInviteTeammateExposure, isCliLimitResourceKind, queueCliLimitNoticeEngagement, queueCliLimitNoticeExposure, takeFirstSyncStepOutcomes, takeCliLimitNoticeEngagements, takeCliLimitNoticeExposures, takeCliInviteNudgeEvents, takePlanLimitInviteTeammateExposures, maybeShowFirstSyncNextStep, } from "./utils/cli-telemetry.js";
 import { reportCliClientHealthInvocation } from "./utils/client-health.js";
 import { settleWithin } from "./utils/settle-with-timeout.js";
 import { emitPlanLimitNag } from "./lib/plan-limit-nag.js";
@@ -313,6 +313,7 @@ export async function runCli() {
             // slice even when the command itself was long-running.
             const releaseHealthTimeoutMs = foregroundNetworkBudget.timeoutFor(FINALIZATION_FOREGROUND_WAIT_MS);
             const firstSyncOutcomeFlushes = takeFirstSyncStepOutcomes().map((outcome) => emitCliFirstSyncNextStepOutcome(outcome, releaseHealthTimeoutMs));
+            const inviteNudgeOutcomeFlushes = takeCliInviteNudgeEvents().map((event) => emitCliInviteNudgeEvent(event, releaseHealthTimeoutMs));
             const inviteTeammateExposureFlushes = takePlanLimitInviteTeammateExposures().map((companyUid) => emitPlanLimitInviteTeammateExposure(companyUid, releaseHealthTimeoutMs));
             const limitNoticeExposureFlushes = takeCliLimitNoticeExposures().map((exposure) => emitCliLimitNoticeExposure(exposure, releaseHealthTimeoutMs));
             const limitNoticeEngagementFlushes = takeCliLimitNoticeEngagements().map((engagement) => emitCliLimitNoticeEngagement(engagement, releaseHealthTimeoutMs));
@@ -322,6 +323,7 @@ export async function runCli() {
                     : [refreshVersionCache({ timeoutMs: releaseHealthTimeoutMs })]),
                 Sentry.flush(releaseHealthTimeoutMs),
                 ...firstSyncOutcomeFlushes,
+                ...inviteNudgeOutcomeFlushes,
                 ...inviteTeammateExposureFlushes,
                 ...limitNoticeExposureFlushes,
                 ...limitNoticeEngagementFlushes,

package/dist/utils/cli-telemetry.d.ts

@@ -9,8 +9,14 @@ export declare const TELEMETRY_TIMEOUT_MS = 1200;
  */
 export declare const TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when you run a signed-in command (CLI version and a timestamp, never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.";
 export declare const FIRST_SYNC_TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when you run a signed-in command (CLI version and a timestamp; first-sync guidance shown or followed, with the identifier cli.first-sync-next-step; never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.";
+export declare const CLI_INVITE_NUDGE_TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when it shows the teammate invite prompt (your company UID and whether you saw, clicked, or dismissed the prompt; no invitee details, command names, file contents, or secrets). Set HQ_TELEMETRY=0 to turn this off.";
 export declare const CLI_FEATURE_USED_TELEMETRY_FLAG = "cli.feature-used-telemetry-v1";
 export declare const CLI_FEATURE_USED_TELEMETRY_DISCLOSURE_LINE = "HQ sends a feature-use event when you run a supported CLI feature (feature kind and outcome, plus your company UID when available; never command names, file contents, or secrets). The hq-flags key cli.feature-used-telemetry-v1 controls these events. Set HQ_TELEMETRY=0 to turn this off.";
+export type CliInviteNudgeOutcome = "shown" | "clicked" | "dismissed";
+export interface CliInviteNudgeEvent {
+    companyUid: string;
+    outcome: CliInviteNudgeOutcome;
+}
 export declare const CLI_LIMIT_AT_ACTION_PROMPT_FLAG = "billing.limit-at-action-prompt";
 export type CliLimitResourceKind = "users" | "integrations" | "secrets" | "agents" | "deployments" | "storageBytes";
 export type CliLimitPresentationKind = "advisory" | "refusal";
@@ -33,6 +39,11 @@ export declare function takeCliLimitNoticeEngagements(): CliLimitNoticeEngagemen
 export declare function queuePlanLimitInviteTeammateExposure(companyUid: string): void;
 /** Drain invite-suggestion exposures for the bounded command-finalization flush. */
 export declare function takePlanLimitInviteTeammateExposures(): string[];
+/** Queue one company-keyed CLI invite prompt outcome; no person UID is included in the event. */
+export declare function queueCliInviteNudgeEvent(companyUid: string, outcome: CliInviteNudgeOutcome): void;
+export declare function takeCliInviteNudgeEvents(): CliInviteNudgeEvent[];
+/** Emit a bounded CLI session fact through the existing product-telemetry path. */
+export declare function emitCliInviteNudgeEvent(event: CliInviteNudgeEvent, timeoutMs?: number): Promise<void>;
 export type CliFeatureKind = "secret_read" | "lane_create" | "lane_resume";
 export type CliFeatureOutcome = "success" | "failure";
 export interface CliFeatureUsage {

package/dist/utils/cli-telemetry.js

@@ -17,14 +17,17 @@ export const TELEMETRY_TIMEOUT_MS = 1_200;
  */
 export const TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when you run a signed-in command (CLI version and a timestamp, never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.";
 export const FIRST_SYNC_TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when you run a signed-in command (CLI version and a timestamp; first-sync guidance shown or followed, with the identifier cli.first-sync-next-step; never command names, file contents, or secrets) to improve the CLI. Set HQ_TELEMETRY=0 to turn this off.";
+export const CLI_INVITE_NUDGE_TELEMETRY_DISCLOSURE_LINE = "HQ sends a usage event when it shows the teammate invite prompt (your company UID and whether you saw, clicked, or dismissed the prompt; no invitee details, command names, file contents, or secrets). Set HQ_TELEMETRY=0 to turn this off.";
 export const CLI_FEATURE_USED_TELEMETRY_FLAG = "cli.feature-used-telemetry-v1";
 export const CLI_FEATURE_USED_TELEMETRY_DISCLOSURE_LINE = "HQ sends a feature-use event when you run a supported CLI feature (feature kind and outcome, plus your company UID when available; never command names, file contents, or secrets). The hq-flags key cli.feature-used-telemetry-v1 controls these events. Set HQ_TELEMETRY=0 to turn this off.";
 const TELEMETRY_DISABLED_VALUES = new Set(["0", "false", "off"]);
 const DISCLOSURE_MARKER = "cli-telemetry-disclosed";
 const FIRST_SYNC_DISCLOSURE_MARKER = "cli-telemetry-disclosed-first-sync-v1";
+const INVITE_NUDGE_DISCLOSURE_MARKER = "cli-telemetry-disclosed-invite-nudge-v1";
 const FEATURE_USED_DISCLOSURE_MARKER = "cli-telemetry-disclosed-feature-used-v1";
 let cliSessionStartedPromise;
 const pendingPlanLimitInviteTeammateExposures = [];
+const pendingCliInviteNudgeEvents = [];
 export const CLI_LIMIT_AT_ACTION_PROMPT_FLAG = "billing.limit-at-action-prompt";
 const pendingCliLimitNoticeExposures = [];
 const pendingCliLimitNoticeEngagements = [];
@@ -68,6 +71,73 @@ export function queuePlanLimitInviteTeammateExposure(companyUid) {
 export function takePlanLimitInviteTeammateExposures() {
     return pendingPlanLimitInviteTeammateExposures.splice(0, pendingPlanLimitInviteTeammateExposures.length);
 }
+/** Queue one company-keyed CLI invite prompt outcome; no person UID is included in the event. */
+export function queueCliInviteNudgeEvent(companyUid, outcome) {
+    if (!/^cmp_[A-Za-z0-9_-]{1,128}$/.test(companyUid))
+        return;
+    pendingCliInviteNudgeEvents.push({ companyUid, outcome });
+}
+export function takeCliInviteNudgeEvents() {
+    return pendingCliInviteNudgeEvents.splice(0, pendingCliInviteNudgeEvents.length);
+}
+/** Emit a bounded CLI session fact through the existing product-telemetry path. */
+export async function emitCliInviteNudgeEvent(event, timeoutMs = TELEMETRY_TIMEOUT_MS) {
+    try {
+        if (isCliTelemetryDisabled())
+            return;
+        const cached = loadCachedTokens();
+        if (!cached || isExpiring(cached, 120) || !cached.accessToken ||
+            !isHumanInteractiveCliSession({
+                stdoutIsTTY: Boolean(process.stdout.isTTY),
+                argv: process.argv,
+                env: process.env,
+                machineIdentity: isMachineIdentity(),
+            }) || process.stdin.isTTY !== true)
+            return;
+        if (!maybeDiscloseInviteNudgeTelemetry())
+            return;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const response = await vaultApiFetch({
+                token: cached.accessToken,
+                path: "/v1/telemetry/events",
+                method: "POST",
+                body: {
+                    events: [{
+                            eventName: "cli_session_started",
+                            app: "hq-cli",
+                            source: "cli",
+                            occurredAt: new Date().toISOString(),
+                            consentBasis: "disclosed",
+                            schemaVersion: 1,
+                            companyUid: event.companyUid,
+                            properties: {
+                                version: CLI_VERSION,
+                                step: "invite_teammate_nudge",
+                                outcome: event.outcome,
+                            },
+                        }],
+                },
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                console.error(`hq: Could not send invite prompt telemetry (http_${response.status}).`);
+            }
+        }
+        catch (error) {
+            const errorClass = error instanceof Error ? error.name : "unknown";
+            console.error(`hq: Could not send invite prompt telemetry (${errorClass}).`);
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    catch (error) {
+        const errorClass = error instanceof Error ? error.name : "unknown";
+        console.error(`hq: Could not prepare invite prompt telemetry (${errorClass}).`);
+    }
+}
 const COMPANY_UID_PATTERN = /^cmp_[A-Za-z0-9_-]{1,128}$/;
 export function isCliLimitResourceKind(value) {
     return ["users", "integrations", "secrets", "agents", "deployments", "storageBytes"].includes(value);
@@ -172,6 +242,9 @@ export function telemetryDisclosureMarkerPath() {
 function firstSyncTelemetryDisclosureMarkerPath() {
     return path.join(hqConfigDir(), FIRST_SYNC_DISCLOSURE_MARKER);
 }
+function inviteNudgeTelemetryDisclosureMarkerPath() {
+    return path.join(hqConfigDir(), INVITE_NUDGE_DISCLOSURE_MARKER);
+}
 function featureUsedTelemetryDisclosureMarkerPath() {
     return path.join(hqConfigDir(), FEATURE_USED_DISCLOSURE_MARKER);
 }
@@ -212,6 +285,9 @@ export function maybeDiscloseCliTelemetry(stderr = process.stderr, stdout = proc
 function maybeDiscloseFirstSyncTelemetry() {
     return maybeDiscloseTelemetry(FIRST_SYNC_TELEMETRY_DISCLOSURE_LINE, firstSyncTelemetryDisclosureMarkerPath());
 }
+function maybeDiscloseInviteNudgeTelemetry() {
+    return maybeDiscloseTelemetry(CLI_INVITE_NUDGE_TELEMETRY_DISCLOSURE_LINE, inviteNudgeTelemetryDisclosureMarkerPath());
+}
 function maybeDiscloseFeatureUsedTelemetry() {
     return maybeDiscloseTelemetry(CLI_FEATURE_USED_TELEMETRY_DISCLOSURE_LINE, featureUsedTelemetryDisclosureMarkerPath());
 }

package/dist/utils/run-bundled-script.d.ts

@@ -8,10 +8,11 @@
  *
  * Deliberate choices:
  *
- *   - `stdio: "inherit"`. Not piped. Piping would buffer output that callers
- *     stream, reorder stdout against stderr, and require re-emitting bytes we
- *     have no reason to touch. Inheriting also means a script that reads stdin
- *     (the hook payload pattern) gets the real fd, unbuffered and unconsumed.
+ *   - stdio inherits by default. Captured runs pipe only stdout/stderr, and
+ *     inherit stdin unless the caller supplies an explicit payload. Piping
+ *     output would buffer streams, reorder stdout against stderr, and require
+ *     re-emitting bytes, so capture remains an explicit opt-in for native
+ *     parity fallbacks that need the shell's exact output bytes.
  *
  *   - an explicit interpreter (`bash` or `node`) rather than executing the file
  *     directly. The executable bit does survive `npm publish` for files that
@@ -52,6 +53,8 @@ export type RunBundledScriptOptions = {
     env?: Record<string, string | undefined>;
     /** Capture stdout and stderr as bytes instead of inheriting those streams. */
     captureOutput?: boolean;
+    /** Bytes supplied on stdin. With no value, stdin is inherited as before. */
+    stdin?: string | Buffer;
 };
 export type RunBundledScriptResult = {
     /** The child's exit code, or 128+signal if it was terminated by one. */

package/dist/utils/run-bundled-script.js

@@ -8,10 +8,11 @@
  *
  * Deliberate choices:
  *
- *   - `stdio: "inherit"`. Not piped. Piping would buffer output that callers
- *     stream, reorder stdout against stderr, and require re-emitting bytes we
- *     have no reason to touch. Inheriting also means a script that reads stdin
- *     (the hook payload pattern) gets the real fd, unbuffered and unconsumed.
+ *   - stdio inherits by default. Captured runs pipe only stdout/stderr, and
+ *     inherit stdin unless the caller supplies an explicit payload. Piping
+ *     output would buffer streams, reorder stdout against stderr, and require
+ *     re-emitting bytes, so capture remains an explicit opt-in for native
+ *     parity fallbacks that need the shell's exact output bytes.
  *
  *   - an explicit interpreter (`bash` or `node`) rather than executing the file
  *     directly. The executable bit does survive `npm publish` for files that
@@ -30,6 +31,7 @@
  */
 import { spawnSync } from "child_process";
 import * as fs from "node:fs";
+import * as os from "node:os";
 import * as path from "path";
 import { resolveBundledAsset } from "./hq-roots.js";
 /**
@@ -152,12 +154,41 @@ export function runBundledScript(opts) {
     if (windowsBash && !windowsBash.executable) {
         throw bashNotFoundError(opts.asset, windowsBash.cause);
     }
-    const result = spawnSync(executable, [script, ...(opts.args ?? [])], {
-        cwd: opts.cwd,
-        env,
-        stdio: opts.captureOutput ? ["inherit", "pipe", "pipe"] : "inherit",
-        ...(opts.captureOutput ? { maxBuffer: Number.MAX_SAFE_INTEGER } : {}),
-    });
+    let inputDirectory;
+    let inputDescriptor;
+    let result;
+    try {
+        if (opts.stdin !== undefined) {
+            // Some scaffold scripts reopen /dev/stdin by pathname. Node's spawnSync
+            // input pipe cannot be reopened through /dev/stdin on Linux, so capture
+            // mode supplies a private regular file descriptor to preserve that ABI.
+            const sharedMemory = process.platform === "linux" && fs.existsSync("/dev/shm")
+                ? "/dev/shm"
+                : os.tmpdir();
+            inputDirectory = fs.mkdtempSync(path.join(sharedMemory, "hq-bundled-stdin-"));
+            const inputPath = path.join(inputDirectory, "stdin");
+            fs.writeFileSync(inputPath, opts.stdin, { mode: 0o600 });
+            inputDescriptor = fs.openSync(inputPath, "r");
+        }
+        const stdinStdio = inputDescriptor ?? "inherit";
+        const stdio = opts.captureOutput
+            ? [stdinStdio, "pipe", "pipe"]
+            : inputDescriptor !== undefined
+                ? [stdinStdio, "inherit", "inherit"]
+                : "inherit";
+        result = spawnSync(executable, [script, ...(opts.args ?? [])], {
+            cwd: opts.cwd,
+            env,
+            stdio,
+            ...(opts.captureOutput ? { maxBuffer: Number.MAX_SAFE_INTEGER } : {}),
+        });
+    }
+    finally {
+        if (inputDescriptor !== undefined)
+            fs.closeSync(inputDescriptor);
+        if (inputDirectory)
+            fs.rmSync(inputDirectory, { recursive: true, force: true });
+    }
     if (result.error) {
         const spawnError = result.error;
         if (process.platform === "win32" &&
@@ -185,8 +216,12 @@ export function runBundledScript(opts) {
     return {
         code,
         ...(opts.captureOutput ? {
-            stdout: result.stdout ?? Buffer.alloc(0),
-            stderr: result.stderr ?? Buffer.alloc(0),
+            stdout: Buffer.isBuffer(result.stdout)
+                ? result.stdout
+                : Buffer.from(result.stdout ?? ""),
+            stderr: Buffer.isBuffer(result.stderr)
+                ? result.stderr
+                : Buffer.from(result.stderr ?? ""),
         } : {}),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.322.0",
+  "version": "5.323.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {