@indigoai-us/hq-cli 5.342.0 → 5.342.2

package/dist/lib/lanes/reconcile.js

@@ -18,7 +18,7 @@ import { AccountResolutionError, LanesError, isLaneVersionConflict } from "./err
 import { loadWorkerProfile } from "./profile.js";
 import { terminalChildResumeHireGrantError, withHireGrantAdmission, } from "./grants.js";
 import { classifySessionLiveness, defaultLivenessDeps, loadLivenessIndex, readDaemonPresenceConnected, unindexedClaudeSessionLiveness, } from "./liveness.js";
-import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, envelopeRepairMode, isPidRecordAlive, laneRunDir, readPidRecord, readProcStarttime, readSpawnManifest, markSpawnFailure, stopLaneProcesses, spawnEnvelopeRepair, spawnLaneWorker, retryLaneOnAlternateAccount, } from "./spawn.js";
+import { ANSWERED_QUESTIONS_FILE, armLaneWatcher, envelopeRepairMode, isPidRecordAlive, laneRunDir, nextEnvelopePath, readPidRecord, readProcStarttime, readSpawnManifest, markSpawnFailure, stopLaneProcesses, spawnEnvelopeRepair, spawnLaneWorker, retryLaneOnAlternateAccount, } from "./spawn.js";
 import { appendCappedHistory, lanesStoreRoot, parseLaneRecord, parseQuestionRecord, readLane, readQuestion, listQuestionIds, updateLane, updateQuestion, } from "./store.js";
 import { applyThrottleDecision, decideAdmission, defaultThrottleDeps, emptyThrottleState, evaluateThrottle, isCpuCheckEnabled, readAvailableMemMb, readThrottleState, resolveCpuBusyFraction, sampleCpuBusyObservation, recordCpuBusyObservation, throttleStatePath, writeThrottleState, } from "./throttle.js";
 import { readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "./registry-flag.js";
@@ -87,6 +87,27 @@ function markDirty(summary, skip) {
     summary.ok = false;
     logSkip(skip);
 }
+function isMissingPathError(error) {
+    const code = error?.code;
+    return code === "ENOENT" || code === "ENOTDIR";
+}
+function recordMissingCodexHomeNote(summary, home) {
+    const note = `Codex rollout retention skipped home absent on this host: ${home}`;
+    summary.notes ??= [];
+    summary.notes.push(note);
+    process.stderr.write(`hq lanes reconcile: note: ${note}\n`);
+}
+function homeIsMissingAfterError(home, error) {
+    if (!isMissingPathError(error))
+        return false;
+    try {
+        fs.statSync(home);
+        return false;
+    }
+    catch (statError) {
+        return isMissingPathError(statError);
+    }
+}
 function terminalizeModelUnsupported(hqRoot, lane, err) {
     if (!(err instanceof LanesError) || err.error !== "model_unsupported")
         return;
@@ -940,14 +961,28 @@ export async function runPassBody(hqRoot, deps) {
                 companyRefs.set(company.uid ?? company.slug, company);
         }
         const readFlag = deps.readRegistryFlag ?? readLanesRegistryFlag;
-        const homes = configuredCodexRolloutHomes(hqRoot, config, deps.host.hostname);
+        const configuredHomes = configuredCodexRolloutHomes(hqRoot, config, deps.host.hostname);
         let retentionEnabled = false;
-        for (const company of homes.length > 0 ? companyRefs.values() : []) {
+        for (const company of configuredHomes.length > 0 ? companyRefs.values() : []) {
             retentionEnabled ||= await readFlag("lanes.codex-rollout-retention", { company });
             if (retentionEnabled)
                 break;
         }
         if (retentionEnabled) {
+            const presentHomes = [];
+            for (const home of configuredHomes) {
+                try {
+                    fs.statSync(home);
+                    presentHomes.push(home);
+                }
+                catch (err) {
+                    if (isMissingPathError(err)) {
+                        recordMissingCodexHomeNote(summary, home);
+                        continue;
+                    }
+                    throw err;
+                }
+            }
             const statePath = path.join(hqRoot, "workspace", "lanes-runs", `.rollout-retention-${deps.host.hostname.replaceAll(/[^a-zA-Z0-9_-]/g, "_")}.json`);
             let lastRunAt;
             try {
@@ -961,20 +996,38 @@ export async function runPassBody(hqRoot, deps) {
                 if (err.code !== "ENOENT")
                     throw err;
             }
-            const lowDisk = homes.some((home) => checkLaneDiskSpace(hqRoot, home, deps.spawnLaneDeps?.statfs, config.low_disk_min_free_bytes).low);
+            let lowDisk = false;
+            const retentionHomes = [];
+            for (const home of presentHomes) {
+                try {
+                    const disk = checkLaneDiskSpace(hqRoot, home, deps.spawnLaneDeps?.statfs, config.low_disk_min_free_bytes);
+                    lowDisk = lowDisk || disk.low;
+                    retentionHomes.push(home);
+                }
+                catch (err) {
+                    if (homeIsMissingAfterError(home, err)) {
+                        recordMissingCodexHomeNote(summary, home);
+                        continue;
+                    }
+                    throw err;
+                }
+            }
             if (lowDisk || lastRunAt === undefined || nowMs - lastRunAt >= 60 * 60 * 1000) {
                 const result = await retainCodexRollouts({
-                    homes,
+                    homes: retentionHomes,
                     lanes,
                     nowMs,
+                    dryRun: deps.dryRun,
                     compressAfterMs: config.codex_rollout_compress_after_hours * 60 * 60 * 1000,
                     deleteAfterMs: config.codex_rollout_delete_after_days * 24 * 60 * 60 * 1000,
                 });
                 summary.rollout_retention = result;
-                fs.mkdirSync(path.dirname(statePath), { recursive: true });
-                const tempPath = `${statePath}.${process.pid}.tmp`;
-                fs.writeFileSync(tempPath, `${JSON.stringify({ last_run_at: nowIso }, null, 2)}\n`, { flag: "wx" });
-                fs.renameSync(tempPath, statePath);
+                if (!deps.dryRun) {
+                    fs.mkdirSync(path.dirname(statePath), { recursive: true });
+                    const tempPath = `${statePath}.${process.pid}.tmp`;
+                    fs.writeFileSync(tempPath, `${JSON.stringify({ last_run_at: nowIso }, null, 2)}\n`, { flag: "wx" });
+                    fs.renameSync(tempPath, statePath);
+                }
             }
         }
     }
@@ -1848,6 +1901,9 @@ async function admitQueued(hqRoot, lanes, summary, deps, now, onlyLaneIds, exclu
         }
         try {
             if (deps.dryRun) {
+                // Spawn reserves an envelope path. Probe it without writing so a dry
+                // run does not promise admission when the run cannot start.
+                nextEnvelopePath(laneRunDir(hqRoot, lane.lane_id));
                 summary.admitted.push({
                     id: lane.lane_id,
                     from: "queued",
@@ -1907,6 +1963,18 @@ async function admitQueued(hqRoot, lanes, summary, deps, now, onlyLaneIds, exclu
                 }
             }
             terminalizeModelUnsupported(hqRoot, lane, err);
+            if (err instanceof LanesError && err.error !== "model_unsupported") {
+                const queueRecorded = deps.dryRun || casLaneIf(hqRoot, lane.lane_id, (current) => current.state === "queued", (current) => ({
+                    ...current,
+                    queued_reason: "admit_failed",
+                    queued_details: { reason: "admit_failed", error: err.error, message: err.message },
+                    admission_reserved_at: undefined,
+                }), false).changed;
+                if (queueRecorded) {
+                    summary.skipped.push({ kind: "lane", id: lane.lane_id, why: `admit_failed:${err.error}` });
+                    continue;
+                }
+            }
             markDirty(summary, {
                 kind: "lane",
                 id: lane.lane_id,

package/dist/lib/lanes/spawn.js

@@ -983,16 +983,21 @@ function proveDetachedViaPs(pid) {
 }
 export function nextEnvelopePath(runDir) {
     const dir = path.join(runDir, "envelopes");
+    let names = new Set();
+    try {
+        names = new Set(fs.readdirSync(dir));
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
     let n = 1;
     while (true) {
         const name = `${String(n).padStart(3, "0")}.json`;
         const filePath = path.join(dir, name);
-        if (!fs.existsSync(filePath))
+        if (!names.has(name))
             return filePath;
         n += 1;
-        if (n > 999) {
-            throw new LanesError("envelope_sequence_exhausted", `No free envelope slot under ${dir}`, { dir });
-        }
     }
 }
 export function envelopeInstruction(envelopePath) {

package/dist/lib/lanes/store.js

@@ -623,6 +623,16 @@ export function parseLaneRecord(raw, filePath) {
             }
             requireTimestamp(detailsRecord.measured_at, "queued_details.measured_at", filePath);
         }
+        else if (detailsRecord.reason === "admit_failed") {
+            if (raw.state !== "queued" || raw.queued_reason !== "admit_failed" ||
+                typeof detailsRecord.error !== "string" || detailsRecord.error.trim() === "" ||
+                typeof detailsRecord.message !== "string" || detailsRecord.message.trim() === "") {
+                throw new LaneSchemaError("queued_details must describe a failed lane admission", {
+                    path: filePath,
+                    field: "queued_details",
+                });
+            }
+        }
         else {
             throw new LaneSchemaError("queued_details must describe a supported queue condition", {
                 path: filePath,

package/dist/lib/lanes/types.d.ts

@@ -177,7 +177,7 @@ export declare const TERMINAL_LANE_STATES: readonly ["done", "failed", "interrup
 export type TerminalLaneState = (typeof TERMINAL_LANE_STATES)[number];
 export declare const LANE_PROVIDERS: readonly ["claude", "codex", "grok"];
 export type LaneProvider = (typeof LANE_PROVIDERS)[number];
-export declare const QUEUED_REASONS: readonly ["cap", "provider_cap", "account_cap", "profile_cap", "queue_position", "throttle", "provider_binary_missing", "account_retry", "worker_profile_changed", "low_disk"];
+export declare const QUEUED_REASONS: readonly ["cap", "provider_cap", "account_cap", "profile_cap", "queue_position", "throttle", "provider_binary_missing", "account_retry", "worker_profile_changed", "low_disk", "admit_failed"];
 export type QueuedReason = (typeof QUEUED_REASONS)[number];
 export type QueuedDetails = {
     reason: "worker_profile_changed";
@@ -193,6 +193,10 @@ export type QueuedDetails = {
     hq_free_bytes: number;
     provider_free_bytes: number;
     measured_at: string;
+} | {
+    reason: "admit_failed";
+    error: string;
+    message: string;
 };
 export declare function isQueuedReason(value: unknown): value is QueuedReason;
 export declare const HOST_KINDS: readonly ["local", "outpost"];

package/dist/lib/lanes/types.js

@@ -113,6 +113,7 @@ export const QUEUED_REASONS = [
     "account_retry",
     "worker_profile_changed",
     "low_disk",
+    "admit_failed",
 ];
 export function isQueuedReason(value) {
     return typeof value === "string" && QUEUED_REASONS.includes(value);

package/dist/lib/lanes/watcher.js

@@ -34,6 +34,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
+import { compareEnvelopeNames } from "./envelope-sequence.js";
 import { questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { isTerminalLaneState, ENVELOPE_INVALID_REASON, parseLaneEnvelope, STORY_STATUSES, LANE_PROVIDERS, } from "./types.js";
 import { laneStories, terminalEnvelopeStoryStatus } from "./stories.js";
@@ -619,8 +620,8 @@ export function readLatestEnvelopeFile(hqRoot, laneId, minName) {
         names = fs
             .readdirSync(dir)
             .filter((name) => name.endsWith(".json"))
-            .filter((name) => minName === undefined || name >= minName)
-            .sort();
+            .filter((name) => minName === undefined || compareEnvelopeNames(name, minName) >= 0)
+            .sort(compareEnvelopeNames);
     }
     catch (err) {
         const code = err.code;

package/dist/secrets-env-action.d.ts

@@ -0,0 +1,103 @@
+import { writeSync } from "node:fs";
+/**
+ * A browser login is safe only when a person can answer it. This mirrors the
+ * repository's existing terminal convention in `canOfferTeamUpgrade`: both
+ * stdin and stderr must be TTYs, and CI is always non-interactive.
+ */
+export declare function secretsCredentialOptions(): {
+    interactive: boolean;
+};
+export interface SecretsScopeOpts {
+    company?: string;
+    personal?: boolean;
+}
+export declare function scopeOpts(opts: SecretsScopeOpts): {
+    personal: boolean;
+    companySlug: string | undefined;
+};
+export type SecretTier = "standard" | "sensitive" | "nuclear";
+export type SecretScriptLockMode = "off" | "enforced";
+export type SecretUsageChannel = "run" | "exec" | "env" | "sandbox" | "reveal" | "submit-link";
+export interface SecretScriptUsage {
+    scriptId: string;
+    path: string;
+    sha256: string;
+    attestationLevel: string;
+}
+export interface SecretUsage {
+    channel: SecretUsageChannel;
+    reason?: string;
+    script?: SecretScriptUsage;
+}
+export interface SecretMetadata {
+    tier?: SecretTier;
+    scriptLock?: {
+        mode?: SecretScriptLockMode;
+        requiredAttestation?: string;
+    };
+    cacheTtlMs?: number;
+    revokedAt?: string | null;
+}
+export interface SecretLoadSuccessRow extends SecretMetadata {
+    name: string;
+    value?: string;
+    version?: number;
+}
+export interface SecretLoadResponse {
+    secrets: SecretLoadSuccessRow[];
+    errors: Array<{
+        name: string;
+        code: string;
+        message?: string;
+    }>;
+}
+export declare function highSecuritySandboxOnlyMessage(secretName?: string): string;
+export declare function normalizeSecretTier(tier?: string): SecretTier;
+export declare function normalizeScriptLockMode(mode?: string): SecretScriptLockMode;
+export declare function extractApiMessage(body: Record<string, unknown>, fallback: string): string;
+export declare function buildSecretUsage(channel: SecretUsageChannel, scriptPath?: string, scriptId?: string, attestationLevel?: string): Promise<SecretUsage>;
+export declare function parseSecretNameList(input: string[] | undefined): string[];
+export declare function loadRevealedSecrets(token: string, companyUid: string, keys: string[], usage?: SecretUsage, options?: {
+    allowOfflineFallback?: boolean;
+}): Promise<Map<string, string>>;
+/**
+ * Emit `hq secrets env` output and terminate deterministically.
+ *
+ * The process MUST exit even when the consuming pipe has gone away. The
+ * orphaned-process leak (personal/projects/hq-secrets-process-leak) was caused
+ * by relying on `process.stdout.write(payload, () => process.exit(0))`: when the
+ * parent shell reading `source <(hq secrets env …)` is killed on timeout, the
+ * stdout pipe loses its reader, the write callback never fires, `process.exit(0)`
+ * is never reached, and — because `env` forces no other exit — the process parks
+ * in `epoll_pwait(-1)` forever, reparented to PID 1. Hundreds accumulated this
+ * way, exhausting swap and driving load into triple digits.
+ *
+ * Writing synchronously to fd 1 and then exiting unconditionally removes every
+ * dependency on the event loop draining and on the reader still being attached:
+ * - a live reader receives the export lines (synchronous write reaches the
+ *   kernel pipe buffer before we exit, so nothing is truncated);
+ * - a dead reader surfaces as EPIPE, which we swallow — the secret is already
+ *   resolved and there is nothing left to deliver, so a clean exit is correct;
+ * - EAGAIN (stdout in non-blocking mode with a momentarily full buffer) is
+ *   retried a bounded number of times. `env` payloads are a few short export
+ *   lines, far under the 64 KiB pipe buffer, so this effectively never spins.
+ *
+ * `exit` and `write` are injectable for tests; production uses the real ones.
+ */
+export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
+/**
+ * Shared `secrets env` action for Commander and the default-off lightweight
+ * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
+ * server authorization, cache-fallback, redaction, and output code.
+ */
+export declare function runSecretsEnvCommand(opts: {
+    only: string[];
+    script?: string;
+    scriptId?: string;
+}, parentScope: {
+    company?: string;
+    personal?: boolean;
+}, options?: {
+    fallbackOnAuthFailure?: boolean;
+}): Promise<"handled" | "fallback">;
+//# sourceMappingURL=secrets-env-action.d.ts.map